CVE-2017-14923

MEDIUM

Tine 2.0 CE <2017.08.4 - XSS

Title source: llm
STIX 2.1

Description

Stored XSS vulnerability via IMG element at "Leadname" of CRM in Tine 2.0 Community Edition before 2017.08.4 allows an authenticated user to inject JavaScript, which is mishandled during rendering by the application administrator and other users.

References (5)

Core 5
Core References
Issue Tracking, Patch, Release Notes, Third Party Advisory x_refsource_misc
https://github.com/tine20/Tine-2.0-Open-Source-Groupware-and-CRM/releases
Mailing List, Patch, Third Party Advisory x_refsource_misc
http://openwall.com/lists/oss-security/2017/09/28/11

Scores

CVSS v3 5.4
EPSS 0.0032
EPSS Percentile 55.4%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Details

CWE
CWE-79
Status published
Products (1)
tine20/tine_2.0 < 2017.08.3
Published Sep 30, 2017
Tracked Since Feb 18, 2026