CVE-2018-17302

2018-09-2107:29:01

Google

osv.dev

5.8 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

30.7%

JSON

Stored XSS exists in views/fields/wysiwyg.js in EspoCRM 5.3.6 via a /#Email/view saved draft message.

CPENameOperatorVersion
espocrmeq4.2.6
espocrmeq3.9.1
espocrmeq4.6.0
espocrmeq4.0.2
espocrmeq4.4.1
espocrmeq3.5.0
espocrmeq4.2.2
espocrmeq4.4.0
espocrmeq4.0.0-beta.1
espocrmeq4.7.0

Name	Operator	Version
espocrm	eq	4.2.6
espocrm	eq	3.9.1
espocrm	eq	4.6.0
espocrm	eq	4.0.2
espocrm	eq	4.4.1
espocrm	eq	3.5.0
espocrm	eq	4.2.2
espocrm	eq	4.4.0
espocrm	eq	4.0.0-beta.1
espocrm	eq	4.7.0

Rows per page:

1-10 of 1161

References

github.com/espocrm/espocrm/issues/1039

github.com/security-breachlock/CVE-2018-17302/blob/master/XSS%20%28Stored%29%20in%20EspoCRM.pdf