CVE-2019-14547 Cross-site scripting in n/a

What is CVE-2019-14547?

CVE-2019-14547 is a medium-severity cross-site scripting vulnerability in n/a, published on 5 Aug 2019. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.

Official description

An issue was discovered in EspoCRM before 5.6.9. Stored XSS was executed when a attacker sends an attachment to admin with malicious JavaScript in the filename. This JavaScript executed when an admin selects the particular file from the list of all attachments. The attacker could inject the JavaScript inside the filename and send it to users, thus helping him steal victims' cookies (hence compromising their accounts).

Weakness: CWE-79

Which versions are affected by CVE-2019-14547?

It affects 1 product.

Products include Espocrm Espocrm.

How do I fix CVE-2019-14547?

No fix has been published for CVE-2019-14547 yet. Limit exposure of the affected software until one is available.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2019-14547 being exploited?

There is no known exploitation of CVE-2019-14547 in the wild and no public exploit code.

Other vulnerabilities in n/a

• CVE-2014-7985 Path traversal in n/a Critical 10.0
• CVE-2026-33656 Path traversal in espocrm Critical 9.1
• CVE-2022-38843 File upload in n/a High 8.8
• CVE-2019-14351 Information disclosure in n/a High 8.8
• CVE-2020-37094 EspoCRM 5.7.0 < 5.9.0 - Two-Factor Authentication Bypass via Auth Token Reuse Between Accounts with Identical Passwords High 8.6

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-wgp8-pjj7-7h3v.