Stored XSS in EspoCRM Affects Email Functionality

CVE-2019-14546

What is CVE-2019-14546?

EspoCRM versions prior to 5.6.9 are susceptible to a stored XSS vulnerability allowing attackers to inject malicious JavaScript into email signatures. When victims receive and interact with an infected email, their cookies may be compromised, leading to unauthorized account access. The vulnerability originates from improper handling of input on the Preference page, particularly when malicious payloads are inserted into the Email Signature field.

References