CVE-2019-14550

{"id": "CVE-2019-14550", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 3.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N", "authentication": "SINGLE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "LOW", "obtainAllPrivilege": false, "exploitabilityScore": 6.8, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.0", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.3}]}, "published": "2019-08-05T19:15:11.600", "references": [{"url": "https://gauravnarwani.com/publications/cve-2019-14550/", "tags": ["Exploit", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://github.com/espocrm/espocrm/commit/ffd3f762ce4a8de3b8962f33513e073c55d943b5", "tags": ["Patch", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://github.com/espocrm/espocrm/issues/1369", "tags": ["Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://github.com/espocrm/espocrm/releases/tag/5.6.9", "tags": ["Release Notes", "Third Party Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "An issue was discovered in EspoCRM before 5.6.9. Stored XSS was executed when a victim clicks on the Edit Dashboard feature present on the Homepage. An attacker can load malicious JavaScript inside the add tab list feature, which would fire when a user clicks on the Edit Dashboard button, thus helping him steal victims' cookies (hence compromising their accounts)."}, {"lang": "es", "value": "Se detect\u00f3 un problema en EspoCRM anterior a versi\u00f3n 5.6.9. Un ataque de tipo XSS almacenado fue ejecutado cuando una v\u00edctima hace clic en la funcionalidad Edit Dashboard presente en la P\u00e1gina de Inicio. Un atacante puede cargar JavaScript malicioso dentro de la funcionalidad add tab list, que se disparar\u00eda cuando un usuario hace clic en el bot\u00f3n Edit Dashboard, ayud\u00e1ndolo as\u00ed a robar las cookies de las v\u00edctimas (comprometiendo sus cuentas)."}], "lastModified": "2019-08-09T19:54:10.120", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:espocrm:espocrm:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8863F2C2-81D8-4EC9-9EB7-05652984FDE1", "versionEndExcluding": "5.6.9"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}