CVE-2017-14923

2017-09-3001:29:01

Google

osv.dev

5.6 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

40.0%

JSON

Stored XSS vulnerability via IMG element at “Leadname” of CRM in Tine 2.0 Community Edition before 2017.08.4 allows an authenticated user to inject JavaScript, which is mishandled during rendering by the application administrator and other users.

CPENameOperatorVersion
tine-2.0-open-source-groupware-and-crmeq2012-03-beta1-1
tine-2.0-open-source-groupware-and-crmeq2014.09.6
tine-2.0-open-source-groupware-and-crmeq2012-03-beta2-1
tine-2.0-open-source-groupware-and-crmeq2011-05-5
tine-2.0-open-source-groupware-and-crmeq2017.02.1
tine-2.0-open-source-groupware-and-crmeq2012-03-alpha2-2
tine-2.0-open-source-groupware-and-crmeq2013.10.6
tine-2.0-open-source-groupware-and-crmeq2013.03.1-beta1
tine-2.0-open-source-groupware-and-crmeq2013.10.1-rc1
tine-2.0-open-source-groupware-and-crmeq2013.10.3

Name	Operator	Version
tine-2.0-open-source-groupware-and-crm	eq	2012-03-beta1-1
tine-2.0-open-source-groupware-and-crm	eq	2014.09.6
tine-2.0-open-source-groupware-and-crm	eq	2012-03-beta2-1
tine-2.0-open-source-groupware-and-crm	eq	2011-05-5
tine-2.0-open-source-groupware-and-crm	eq	2017.02.1
tine-2.0-open-source-groupware-and-crm	eq	2012-03-alpha2-2
tine-2.0-open-source-groupware-and-crm	eq	2013.10.6
tine-2.0-open-source-groupware-and-crm	eq	2013.03.1-beta1
tine-2.0-open-source-groupware-and-crm	eq	2013.10.1-rc1
tine-2.0-open-source-groupware-and-crm	eq	2013.10.3