CVE-2017-14923

Published: Sep 30, 2017Modified: May 13, 2026

5.4

Vector

CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Exploitability: 2.3 / Impact: 2.7

Source: NVD

Description

Stored XSS vulnerability via IMG element at "Leadname" of CRM in Tine 2.0 Community Edition before 2017.08.4 allows an authenticated user to inject JavaScript, which is mishandled during rendering by the application administrator and other users.

Affected (1)

Products: Tine20: Tine 2.0

Tine20

1 product

Tine 2.0

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Tine20 Tine 2.0	Up to 2017.08.3

Related CWEs

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References (10)

http://openwall.com/lists/oss-security/2017/09/28/11

Source: cve@mitre.org

Mailing ListPatchThird Party Advisory

https://github.com/tine20/Tine-2.0-Open-Source-Groupware-and-CRM/commit/146c5aaafd826c1c8990333c393bff6f64c90786

Source: cve@mitre.org

Issue TrackingPatchThird Party Advisory

https://github.com/tine20/Tine-2.0-Open-Source-Groupware-and-CRM/commit/24e39e1e930097b8793a03b8864d3c484ede546b

Source: cve@mitre.org

Issue TrackingPatchThird Party Advisory

https://github.com/tine20/Tine-2.0-Open-Source-Groupware-and-CRM/commit/bc8a6fbd3128cf5ef27d808f6c6ba869fdc2262b

Source: cve@mitre.org

Issue TrackingPatchThird Party Advisory

https://github.com/tine20/Tine-2.0-Open-Source-Groupware-and-CRM/releases

Source: cve@mitre.org

Issue TrackingPatchRelease NotesThird Party Advisory

http://openwall.com/lists/oss-security/2017/09/28/11

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListPatchThird Party Advisory

https://github.com/tine20/Tine-2.0-Open-Source-Groupware-and-CRM/commit/146c5aaafd826c1c8990333c393bff6f64c90786

Source: af854a3a-2127-422b-91ae-364da2661108

Issue TrackingPatchThird Party Advisory

https://github.com/tine20/Tine-2.0-Open-Source-Groupware-and-CRM/commit/24e39e1e930097b8793a03b8864d3c484ede546b

Source: af854a3a-2127-422b-91ae-364da2661108

Issue TrackingPatchThird Party Advisory

https://github.com/tine20/Tine-2.0-Open-Source-Groupware-and-CRM/commit/bc8a6fbd3128cf5ef27d808f6c6ba869fdc2262b

Source: af854a3a-2127-422b-91ae-364da2661108

Issue TrackingPatchThird Party Advisory

https://github.com/tine20/Tine-2.0-Open-Source-Groupware-and-CRM/releases

Source: af854a3a-2127-422b-91ae-364da2661108

Issue TrackingPatchRelease NotesThird Party Advisory

Timeline

No history available yet.