CVE-2019-14548: XSS
An issue was discovered in EspoCRM before 5.6.9. Stored XSS in the body of an Article was executed when a victim opens articles received through mail. This Article can be formed by an attacker using the Knowledge Base feature in the tab list. The attacker could inject malicious JavaScript inside the body of the article, thus helping him steal victims' cookies (hence compromising their accounts).
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2019-14548?
CVE-2019-14548 is a vulnerability discovered in EspoCRM before version 5.6.9 that allows for stored cross-site scripting (XSS) attacks.
How does CVE-2019-14548 work?
CVE-2019-14548 allows an attacker to execute malicious JavaScript code when a victim opens articles received through mail in EspoCRM.
What is the severity of CVE-2019-14548?
The severity of CVE-2019-14548 is rated as medium with a CVSS score of 5.4.
How can CVE-2019-14548 be exploited?
CVE-2019-14548 can be exploited by an attacker using the Knowledge Base feature in EspoCRM to inject malicious JavaScript code into the body of an Article.
Is there a fix for CVE-2019-14548?
Yes, the vulnerability has been fixed in EspoCRM version 5.6.9 and later.