CVE-2022-38845 | BDVDB-2026-184802 Detail

Description#

Cross Site Scripting in Import feature in EspoCRM 7.1.8 allows remote users to run malicious JavaScript in victim s browser via sending crafted csv file containing malicious JavaScript to authenticated user. Any authenticated user importing the crafted CSV file may end up running the malicious JavaScripting in the browser.

Impact#

No impact statement in the source data.

Weaknesses#

No weakness recorded in the source data.

References#

https://medium.com/cybersecurity-valuelabs/espocrm-7-1-8-is-vulnerable-to-cross-site-scripting-e3e6c708df18

Exploit#

No public exploit known

History#

Version 12022-09-16Record published in the CVE List.
Version 22024-08-03Most recent update recorded in the CVE List.