CVE-2022-38845

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2022-38845
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-38845.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2022-38845
Aliases
Published
2022-09-16T13:24:36Z
Modified
2026-08-12T03:51:38Z
Summary
[none]
Details

Cross Site Scripting in Import feature in EspoCRM 7.1.8 allows remote users to run malicious JavaScript in victim s browser via sending crafted csv file containing malicious JavaScript to authenticated user. Any authenticated user importing the crafted CSV file may end up running the malicious JavaScripting in the browser.

Database specific 
{
    "cna_assigner": "mitre",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/38xxx/CVE-2022-38845.json"
}
References

Affected packages

Git / github.com/espocrm/espocrm

Affected ranges

Type
GIT
Repo
https://github.com/espocrm/espocrm
Events
Introduced
8ec6fa0f52aab91e9109bc91a7687929a858ff6d
Last Affected
8ec6fa0f52aab91e9109bc91a7687929a858ff6d
Database specific
Show details 
{
    "cpe": "cpe:2.3:a:espocrm:espocrm:7.1.8:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "7.1.8"
        },
        {
            "last_affected": "7.1.8"
        }
    ],
    "source": "CPE_STRING"
}

Affected versions

7.*
7.1.8

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-38845.json"