CVE-2019-14350

2019-07-2816:15:10

Google

osv.dev

5.8 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

37.5%

JSON

EspoCRM 5.6.4 is vulnerable to stored XSS due to lack of filtration of user-supplied data in the Knowledge base. A malicious attacker can inject JavaScript code in the body parameter during api/v1/KnowledgeBaseArticle knowledge-base record creation.

CPENameOperatorVersion
espocrmeq4.2.1
espocrmeq4.5.1
espocrmeq3.3.0
espocrmeq5.4.5
espocrmeq1.0.0
espocrmeq3.1.0
espocrmeq4.4.0
espocrmeq4.8.0
espocrmeq3.2.2
espocrmeq5.6.2