CVE-2017-14923 Cross-site scripting in n/a
Authenticated users can inject JavaScript via the Leadname field, leading to stored XSS attacks against administrators and other users.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2017-14923?
CVE-2017-14923 is a medium-severity cross-site scripting vulnerability in n/a, published on 29 Sep 2017. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
Stored XSS vulnerability via IMG element at "Leadname" of CRM in Tine 2.0 Community Edition before 2017.08.4 allows an authenticated user to inject JavaScript, which is mishandled during rendering by the application administrator and other users.
Weakness: CWE-79
Which versions are affected by CVE-2017-14923?
It affects 1 product.
Products include Tine20 Tine 2.0.
How do I fix CVE-2017-14923?
No fix has been published for CVE-2017-14923 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2017-14923 being exploited?
There is no known exploitation of CVE-2017-14923 in the wild and no public exploit code.
Other vulnerabilities in n/a
- CVE-2017-1000164 Tine 2.0 version 2017.02.4 is vulnerable to XSS in the Addressbook resulting code execution and privilege escalation
- CVE-2017-14921 Stored XSS vulnerability via IMG element at "Filename" of Filemanager in Tine 2.0 Community Edition before 2017.08.4 allows an authenticated
- CVE-2017-14922 Stored XSS vulnerability via IMG element at "History" of Profile, Calendar, Tasks, and CRM in Tine 2.0 Community Edition before 2017.08.4 al
Sources
Also known as GHSA-8p7x-6v2f-7qv5.