CVE-2018-17301

2018-09-2107:29:01

Google

osv.dev

6 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

28.6%

JSON

Reflected XSS exists in client/res/templates/global-search/name-field.tpl in EspoCRM 5.3.6 via /#Account in the search panel.

CPENameOperatorVersion
espocrmeq4.2.6
espocrmeq3.9.1
espocrmeq4.6.0
espocrmeq4.0.2
espocrmeq4.4.1
espocrmeq3.5.0
espocrmeq4.2.2
espocrmeq4.4.0
espocrmeq4.0.0-beta.1
espocrmeq4.7.0

Name	Operator	Version
espocrm	eq	4.2.6
espocrm	eq	3.9.1
espocrm	eq	4.6.0
espocrm	eq	4.0.2
espocrm	eq	4.4.1
espocrm	eq	3.5.0
espocrm	eq	4.2.2
espocrm	eq	4.4.0
espocrm	eq	4.0.0-beta.1
espocrm	eq	4.7.0

Rows per page:

1-10 of 1161

References

github.com/espocrm/espocrm/issues/1038

github.com/security-breachlock/CVE-2018-17301/blob/master/Non-persistent%20XSS%20in%20EspoCRM.pdf