CVE-2022-38845

Cross Site Scripting in Import feature in EspoCRM 7.1.8 allows remote users to run malicious JavaScript in victim s browser via sending crafted csv file…

published September 16, 2022

CVSS
—
EPSS
1%
Percentile
54.9
In the wild
Unconfirmed
What it is

Cross Site Scripting in Import feature in EspoCRM 7.1.8 allows remote users to run malicious JavaScript in victim s browser via sending crafted csv file containing malicious JavaScript to authenticated user. Any authenticated user importing the crafted CSV file may end up running the malicious JavaScripting in the browser.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00765 · 54.9th percentile
Published
2022-09-16T13:24Z
EPSS history
Timeline
  • 16 SEP 13:24Z
    Cross Site Scripting in Import feature in EspoCRM 7.1.8 allows remote users to run malicious JavaScript in victim s browser via sending crafted csv file…
    cvelistv5