CVE-2019-14550

Name of the Vulnerable Software and Affected Versions EspoCRM versions prior to 5.6.9

Description The issue allows for stored XSS execution when a victim clicks on the Edit Dashboard feature on the Homepage. An attacker can load malicious JavaScript inside the add tab list feature, which fires when a user clicks on the Edit Dashboard button, allowing the attacker to steal victims' cookies and compromise their accounts.

Recommendations For versions prior to 5.6.9, update to version 5.6.9 or later to resolve the issue. As a temporary workaround, consider restricting access to the Edit Dashboard feature until the update is applied. Avoid using the add tab list feature in the Edit Dashboard until the issue is resolved.