CVE-2019-14549: XSS
An issue was discovered in EspoCRM before 5.6.9. Stored XSS was executed inside the title and breadcrumb of a newly formed entity available to all the users. A malicious user can inject JavaScript in these values of an entity, thus stealing user cookies when someone visits the publicly accessible link.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2019-14549?
CVE-2019-14549 is a vulnerability discovered in EspoCRM before version 5.6.9 that allows for stored Cross-Site Scripting (XSS) attacks.
How does CVE-2019-14549 work?
CVE-2019-14549 allows a malicious user to inject JavaScript code into the title and breadcrumb of an entity in EspoCRM, potentially leading to the theft of user cookies when visited by others.
What is the severity of CVE-2019-14549?
CVE-2019-14549 has a severity rating of medium, with a CVSS score of 5.4.
How can I fix CVE-2019-14549?
To fix CVE-2019-14549, it is recommended to update EspoCRM to version 5.6.9 or higher.
Where can I find more information about CVE-2019-14549?
More information about CVE-2019-14549 can be found at the following references: [link 1](https://gauravnarwani.com/publications/cve-2019-14549/), [link 2](https://github.com/espocrm/espocrm/commit/ffd3f762ce4a8de3b8962f33513e073c55d943b5), [link 3](https://github.com/espocrm/espocrm/issues/1369).