CVE-2019-14547

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

An issue was discovered in EspoCRM before 5.6.9. Stored XSS was executed when a attacker sends an attachment to admin with malicious JavaScript in the filename. This JavaScript executed when an admin selects the particular file from the list of all attachments. The attacker could inject the JavaScript inside the filename and send it to users, thus helping him steal victims' cookies (hence compromising their accounts).

Metrics

CVSS 3.0 5.4/10CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://gauravnarwani.com/publications/cve-2019-14547/Exploit, Third Party Advisory
https://github.com/espocrm/espocrm/commit/ffd3f762ce4a8de3b8962f33513e073c55d943b5Patch, Third Party Advisory
https://github.com/espocrm/espocrm/issues/1369Third Party Advisory
https://github.com/espocrm/espocrm/releases/tag/5.6.9Release Notes, Third Party Advisory
https://gauravnarwani.com/publications/cve-2019-14547/Exploit, Third Party Advisory
https://github.com/espocrm/espocrm/commit/ffd3f762ce4a8de3b8962f33513e073c55d943b5Patch, Third Party Advisory
https://github.com/espocrm/espocrm/issues/1369Third Party Advisory
https://github.com/espocrm/espocrm/releases/tag/5.6.9Release Notes, Third Party Advisory

Timeline

Published: Aug 5, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-145485.4An issue was discovered in EspoCRM before 5.6.9. Stored XSS in the body of an Article was executed when a victim opens articles received thr CVE-2019-145495.4An issue was discovered in EspoCRM before 5.6.9. Stored XSS was executed inside the title and breadcrumb of a newly formed entity available CVE-2019-145505.4An issue was discovered in EspoCRM before 5.6.9. Stored XSS was executed when a victim clicks on the Edit Dashboard feature present on the H CVE-2019-145519.8Das Q before 2019-08-02 allows web sites to execute arbitrary code on client machines, as demonstrated by a cross-origin /install request wi CVE-2019-145534.9Improper authentication in EDK II may allow a privileged user to potentially enable information disclosure via network access.CVE-2019-145564.4Improper initialization in BIOS firmware for 8th, 9th, 10th Generation Intel(R) Core(TM), Intel(R) Celeron(R) Processor 4000 & 5000 Series P CVE-2019-145578.0Buffer overflow in BIOS firmware for 8th, 9th, 10th Generation Intel(R) Core(TM), Intel(R) Celeron(R) Processor 4000 & 5000 Series Processor CVE-2019-145585.7Insufficient control flow management in BIOS firmware for 8th, 9th, 10th Generation Intel(R) Core(TM), Intel(R) Celeron(R) Processor 4000 & CVE-2019-145597.5Uncontrolled resource consumption in EDK II may allow an unauthenticated user to potentially enable denial of service via network access.CVE-2019-14568.8A remote code execution vulnerability exists in Microsoft Windows when the Windows Adobe Type Manager Library improperly handles specially c CVE-2019-145625.5Integer overflow in DxeImageVerificationHandler() EDK II may allow an authenticated user to potentially enable denial of service via local a CVE-2019-145637.8Integer truncation in EDK II may allow an authenticated user to potentially enable escalation of privilege via local access.