CVE-2025-32390

Katalog CVE

CVSS 8.5 · High EPSS 0,38%

Kerentanan Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') pada espocrm. Skor CVSS 3.1 8.5 (High) menurut NVD.

Deskripsi (NVD)

EspoCRM is a free, open-source customer relationship management platform. Prior to version 9.0.8, HTML Injection in Knowledge Base (KB) articles leads to complete page defacement imitating the login page. Authenticated users with the read knowledge article privilege can browse to the KB article and if they submit their credentials, they get captured in plain text. The vulnerability is allowed by overly permissive HTML editing being allowed on the KB articles. Any authenticated user with the privilege to read KB articles is impacted. In an enterprise with multiple applications, the malicious KB article could be edited to match the login pages of other applications, which would make it useful for credential harvesting against other applications as well. Version 9.0.8 contains a patch for the issue.

Rincian

Terbit di NVD

12 Mei 2025

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

8.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

EPSS (30 hari)

0,38% peluang dieksploitasi; lebih tinggi dari 30,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/espocrm/espocrm/security/advisories/GHSA-qrwp-v8v3-hqp2 exploit · advisory vendor
• https://github.com/espocrm/espocrm/commit/6b58d30eec8864de52844bfb8dac346ce5c729d7 patch