Skip to content
CVE PROGRAM SOURCE RECORD6.3 Medium

CVE-2021-3539

EspoCRM Avatar Persistent XSS

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
rapid7

Description

EspoCRM 6.1.6 and prior suffers from a persistent (type II) cross-site scripting (XSS) vulnerability in processing user-supplied avatar images. This issue was fixed in version 6.1.7 of the product.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

EspoCRM EspoCRM

  • 6.1.6 to ≤ 6.1.6affected

References