Re: Stored XSS vulnerability in Tine 2.0 Community Edition <= 2017.08.3

[chbi () chbi eu]

> Stored XSS vulnerability via IMG tag at "History" of Profile, Calendar,
> Tasks and CRM allows an authenticated user to inject JavaScript which is
> triggered by the application administrator and other users.

CVE-2017-14922 has been assigned.

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-14922


> Stored XSS vulnerability via IMG tag at "Leadname" of CRM allows an
> authenticated user to inject JavaScript which is triggered by the
> application administrator and other users.

CVE-2017-14923 has been assigned.

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-14923


> Stored XSS vulnerability via IMG tag at "Filename" of Filemanager allows
> an authenticated user to inject JavaScript which is triggered by the
> application administrator and other users.

CVE-2017-14921 has been assigned.

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-14921


-- 
chbi
https://chbi.eu

GPG: 3DE9 9187 4BE9 EAE6 3CA8  DC20 BA7B 93F9 9037 AE7E
     https://chbi.eu/chbi.asc

Attachment: signature.asc
Description: OpenPGP digital signature