CVE-2019-14549
An issue was discovered in EspoCRM before 5.6.9. Stored XSS was executed inside the title and breadcrumb of a newly formed entity available to all the users. A malicious user can inject JavaScript in these values of an entity, thus stealing user cookies when someone visits the publicly accessible link.
- Affected products
- Espocrm
- Espocrm
- < 5.6.9
- Fix
- Available
- CVSS 3.0
- 5.4 MEDIUM
- EPSS
- 1.1% (63th percentile)
- Weakness
- CWE-79
- NVD status
- Modified
- Published
- 2019-08-05
CVE-2019-14549 at NVD
1 known exploit for CVE-2019-14549
Proof-of-concept code and exploit modules indexed by Sploitus