CVE-2019-14350

EspoCRM 5.6.4 is vulnerable to stored XSS due to lack of filtration of user-supplied data in the Knowledge base

published July 28, 2019

CVSS
—
EPSS
1%
Percentile
58.3
In the wild
Unconfirmed
What it is

EspoCRM 5.6.4 is vulnerable to stored XSS due to lack of filtration of user-supplied data in the Knowledge base. A malicious attacker can inject JavaScript code in the body parameter during api/v1/KnowledgeBaseArticle knowledge-base record creation.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00865 · 58.3th percentile
Published
2019-07-28T15:26Z
EPSS history
Timeline
  • 28 JUL 15:26Z
    EspoCRM 5.6.4 is vulnerable to stored XSS due to lack of filtration of user-supplied data in the Knowledge base
    cvelistv5