CVE Feed

    Dashboard / CVE / CVE-2017-14922

    CVE-2017-14922

    Stored XSS vulnerability via IMG element at "History" of Profile, Calendar, Tasks, and CRM in Tine 2.0 Community Edition before 2017.08.4 allows an authenticated user to inject JavaScript, which is mishandled during rendering by the application administrator and other users.

    Published:Sep 29, 2017
    Last Modified:Apr 20, 2025
    EPS:Sep 29, 2017
    EPSS Score:0.00325
    CVSS Score:5.4

    Affected Products

    Vendor
    Tine20
    Product
    Tine 2.0

    Exploits

    No exploit reference

    References

    http://openwall.com/lists/oss-security/2017/09/28/11
    https://github.com/tine20/Tine-2.0-Open-Source-Groupware-and-CRM/commit/146c5aaafd826c1c8990333c393bff6f64c90786
    https://github.com/tine20/Tine-2.0-Open-Source-Groupware-and-CRM/commit/24e39e1e930097b8793a03b8864d3c484ede546b
    https://github.com/tine20/Tine-2.0-Open-Source-Groupware-and-CRM/commit/bc8a6fbd3128cf5ef27d808f6c6ba869fdc2262b
    https://github.com/tine20/Tine-2.0-Open-Source-Groupware-and-CRM/releases
    http://openwall.com/lists/oss-security/2017/09/28/11
    https://github.com/tine20/Tine-2.0-Open-Source-Groupware-and-CRM/commit/146c5aaafd826c1c8990333c393bff6f64c90786
    https://github.com/tine20/Tine-2.0-Open-Source-Groupware-and-CRM/commit/24e39e1e930097b8793a03b8864d3c484ede546b
    https://github.com/tine20/Tine-2.0-Open-Source-Groupware-and-CRM/commit/bc8a6fbd3128cf5ef27d808f6c6ba869fdc2262b
    https://github.com/tine20/Tine-2.0-Open-Source-Groupware-and-CRM/releases

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High