CVE-2017-14922

CVSS V2 Low 3.5 CVSS V3 Medium 5.4
Description
Stored XSS vulnerability via IMG element at "History" of Profile, Calendar, Tasks, and CRM in Tine 2.0 Community Edition before 2017.08.4 allows an authenticated user to inject JavaScript, which is mishandled during rendering by the application administrator and other users.
Overview
  • CVE ID
  • CVE-2017-14922
  • Assigner
  • cve@mitre.org
  • Vulnerability Status
  • Analyzed
  • Published Version
  • 2017-09-30T01:29:01
  • Last Modified Date
  • 2017-10-05T18:43:39
Weakness Enumerations
CWE URL
CWE-79 http://cwe.mitre.org/data/definitions/79.html
CPE Configuration (Product)
CPE Vulnerable Operator Version Start Version End
cpe:2.3:a:tine20:tine_2.0:*:*:*:*:community:*:*:* 1 OR 2017.08.3
CVSS Version 2
  • Version
  • 2.0
  • Vector String
  • AV:N/AC:M/Au:S/C:N/I:P/A:N
  • Access Vector
  • NETWORK
  • Access Compatibility
  • MEDIUM
  • Authentication
  • SINGLE
  • Confidentiality Impact
  • NONE
  • Integrity Impact
  • PARTIAL
  • Availability Impact
  • NONE
  • Base Score
  • 3.5
  • Severity
  • LOW
  • Exploitability Score
  • 6.8
  • Impact Score
  • 2.9
CVSS Version 3
  • Version
  • 3.0
  • Vector String
  • CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
  • Attack Vector
  • NETWORK
  • Attack Compatibility
  • LOW
  • Privileges Required
  • LOW
  • User Interaction
  • REQUIRED
  • Scope
  • CHANGED
  • Confidentiality Impact
  • LOW
  • Availability Impact
  • NONE
  • Base Score
  • 5.4
  • Base Severity
  • MEDIUM
  • Exploitability Score
  • 2.3
  • Impact Score
  • 2.7
References
Reference URL Reference Tags
https://github.com/tine20/Tine-2.0-Open-Source-Groupware-and-CRM/releases Issue Tracking Release Notes Patch Third Party Advisory
https://github.com/tine20/Tine-2.0-Open-Source-Groupware-and-CRM/commit/bc8a6fbd3128cf5ef27d808f6c6ba869fdc2262b Issue Tracking Patch Third Party Advisory
https://github.com/tine20/Tine-2.0-Open-Source-Groupware-and-CRM/commit/24e39e1e930097b8793a03b8864d3c484ede546b Issue Tracking Patch Third Party Advisory
https://github.com/tine20/Tine-2.0-Open-Source-Groupware-and-CRM/commit/146c5aaafd826c1c8990333c393bff6f64c90786 Issue Tracking Patch Third Party Advisory
http://openwall.com/lists/oss-security/2017/09/28/11 Mailing List Patch Third Party Advisory
Sources
Source Name Source URL
NIST https://nvd.nist.gov/vuln/detail/CVE-2017-14922
MITRE https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-14922
History
Created Old Value New Value Data Type Notes
2022-05-10 08:18:09 Added to TrackCVE
2022-12-02 21:31:56 2017-09-30T01:29Z 2017-09-30T01:29:01 CVE Published Date updated
2022-12-02 21:31:56 2017-10-05T18:43:39 CVE Modified Date updated
2022-12-02 21:31:56 Analyzed Vulnerability Status updated