SB2026092239 - Multiple vulnerabilities in EspoCRM

Description

This security bulletin contains information about 2 vulnerabilities.

1) Cross-site scripting (CVE-ID: N/A)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]

The vulnerability allows a remote attacker to render attacker-controlled HTML in the interface.

The vulnerability exists due to improper output encoding in the LeadCaptureLogRecord.data field rendering when an administrator views a lead capture log record. A remote attacker can submit a Lead Capture public form containing crafted HTML to render attacker-controlled HTML in the interface.

JavaScript execution is prevented by the content security policy, and rendering capabilities are limited.

2) Authentication Bypass by Primary Weakness (CVE-ID: N/A)

CWE-ID: CWE-305 - Authentication Bypass by Primary Weakness

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to disclose certain configuration parameters.

The vulnerability exists due to improper authentication in routes that do not require authentication when processing a login stopped at the second factor. A remote user can use a login that has not completed two-factor authentication to disclose certain configuration parameters.

Exploitation requires knowledge of the username and password of a user with two-factor authentication enabled.

Remediation

Install update from vendor's website.

References

• https://github.com/espocrm/espocrm/security/advisories/GHSA-xfqv-j65r-qqgh
• https://github.com/espocrm/espocrm/security/advisories/GHSA-ph8v-hvf5-wgp9