CVE-2022-38845

{"id": "CVE-2022-38845", "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.8}]}, "published": "2022-09-16T14:15:09.630", "references": [{"url": "https://medium.com/cybersecurity-valuelabs/espocrm-7-1-8-is-vulnerable-to-cross-site-scripting-e3e6c708df18", "tags": ["Exploit", "Third Party Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "Cross Site Scripting in Import feature in EspoCRM 7.1.8 allows remote users to run malicious JavaScript in victim s browser via sending crafted csv file containing malicious JavaScript to authenticated user. Any authenticated user importing the crafted CSV file may end up running the malicious JavaScripting in the browser."}, {"lang": "es", "value": "Una vulnerabilidad de tipo Cross Site Scripting en la funcionalidad Import de EspoCRM versi\u00f3n 7.1.8, permite a usuarios remotos ejecutar JavaScript malicioso en el navegador de la v\u00edctima por medio del env\u00edo de un archivo csv dise\u00f1ado que contiene JavaScript malicioso al usuario autenticado. Cualquier usuario autenticado que importe el archivo CSV dise\u00f1ado puede terminar ejecutando el JavaScript malicioso en el navegador"}], "lastModified": "2023-08-08T14:21:49.707", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:espocrm:espocrm:7.1.8:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D43B363E-F815-45B5-9012-8DA44D92F0FC"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}