CVE-2018-14397

An issue was discovered in Creme CRM 1.6.12. The organization creation page is affected by 9 stored cross-site scripting vulnerabilities involving the name, billing_address-address, billing_address-zipcode, billing_address-city, billing_address-department, shipping_address-address, shipping_address-zipcode, shipping_address-city, and shipping_address-department parameters.

Score

CVSS 3.0 5.4 Medium

Status

Modified - cve@mitre.org

Published

2018-09-07

Last modified

2024-08-05

Weaknesses

CWE-79

Affected products

• Cremecrm (Cremecrm)

References

• https://www.bishopfox.com/news/2018/08/cremecrm-1-6-12-multiple-vulnerabilities/