CVE-2019-14349

EspoCRM version 5.6.4 is vulnerable to stored XSS due to lack of filtration of user-supplied data in the api/v1/Document functionality for storing documents in…

published July 28, 2019

CVSS
—
EPSS
1%
Percentile
58.3
In the wild
Unconfirmed
What it is

EspoCRM version 5.6.4 is vulnerable to stored XSS due to lack of filtration of user-supplied data in the api/v1/Document functionality for storing documents in the account tab. An attacker can upload a crafted file that contains JavaScript code in its name. This code will be executed when a user opens a page of any profile with this.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00865 · 58.3th percentile
Published
2019-07-28T15:26Z
EPSS history
Timeline
  • 28 JUL 15:26Z
    EspoCRM version 5.6.4 is vulnerable to stored XSS due to lack of filtration of user-supplied data in the api/v1/Document functionality for storing documents in…
    cvelistv5