CVE-2019-14549
UnknownEPSS 1.08%
Last modified
CVE-2019-14549 is a vulnerability of currently unknown severity. An issue was discovered in EspoCRM before 5.6.9. Stored XSS was executed inside the title and breadcrumb of a newly formed entity available to all the users. EPSS estimates a 1.08% chance of exploitation in the next 30 days.
Description
An issue was discovered in EspoCRM before 5.6.9. Stored XSS was executed inside the title and breadcrumb of a newly formed entity available to all the users. A malicious user can inject JavaScript in these values of an entity, thus stealing user cookies when someone visits the publicly accessible link.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Espocrm | Espocrm | < 5.6.9 |
References
- https://gauravnarwani.com/publications/cve-2019-14549/Exploit, Third Party Advisory
- https://github.com/espocrm/espocrm/commit/ffd3f762ce4a8de3b8962f33513e073c55d943b5Patch, Third Party Advisory
- https://github.com/espocrm/espocrm/issues/1369Third Party Advisory
- https://github.com/espocrm/espocrm/releases/tag/5.6.9Release Notes, Third Party Advisory
- https://gauravnarwani.com/publications/cve-2019-14549/Exploit, Third Party Advisory
- https://github.com/espocrm/espocrm/commit/ffd3f762ce4a8de3b8962f33513e073c55d943b5Patch, Third Party Advisory
- https://github.com/espocrm/espocrm/issues/1369Third Party Advisory
- https://github.com/espocrm/espocrm/releases/tag/5.6.9Release Notes, Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2019-14549?
An issue was discovered in EspoCRM before 5.6.9. Stored XSS was executed inside the title and breadcrumb of a newly formed entity available to all the users. A malicious user can inject JavaScript in these values of an entity, thus stealing user cookies when someone visits the publicly accessible link.
How severe is CVE-2019-14549?
Severity scoring for CVE-2019-14549 is pending analysis. The EPSS model estimates a 1.08% probability of exploitation in the next 30 days.
How do I fix CVE-2019-14549?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.
Are you affected by CVE-2019-14549?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST