Cross site scripting

2019-07-2814:15:00

PRIOn knowledge base

www.prio-n.com

0.001 Low

EPSS

Percentile

38.0%

JSON

An issue was discovered in EspoCRM before 5.6.6. Stored XSS exists due to lack of filtration of user-supplied data in Create Case. A malicious attacker can modify the firstName and lastName to contain JavaScript code.

CPENameOperatorVersion
espocrmlt5.6.6

CPE	Name	Operator	Version
	espocrm	lt	5.6.6

References

www.cinquino.eu/EspoCRM.htm

github.com/espocrm/espocrm/commit/4ab7d19776011288b875abd3eef1e1f6f75289e2

github.com/espocrm/espocrm/compare/5.6.5...5.6.6

0.001 Low

EPSS

Percentile

38.0%

JSON

Related for PRION:CVE-2019-14330