CVE-2018-17301

EUVD-2018-9056
Reflected XSS exists in client/res/templates/global-search/name-field.tpl in EspoCRM 5.3.6 via /#Account in the search panel.
Cross-site Scripting
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
5.4 MEDIUM
NETWORK
LOW
LOW
CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 40%
Affected Products (NVD)
VendorProductVersion
espocrmespocrm
5.3.6
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://github.com/espocrm/espocrm/issues/1038
https://github.com/security-breachlock/CVE-2018-17301/blob/master/Non-persistent%20XSS%20in%20EspoCRM.pdf
https://github.com/espocrm/espocrm/issues/1038
https://github.com/security-breachlock/CVE-2018-17301/blob/master/Non-persistent%20XSS%20in%20EspoCRM.pdf