{"id":"CVE-2022-38845","details":"Cross Site Scripting in Import feature in EspoCRM 7.1.8 allows remote users to run malicious JavaScript in victim s browser via sending crafted csv file containing malicious JavaScript to authenticated user. Any authenticated user importing the crafted CSV file may end up running the malicious JavaScripting in the browser.","aliases":["BIT-espocrm-2022-38845"],"modified":"2026-08-12T03:51:38.224543264Z","published":"2022-09-16T13:24:36Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/38xxx/CVE-2022-38845.json","cna_assigner":"mitre"},"references":[{"type":"WEB","url":"https://medium.com/cybersecurity-valuelabs/espocrm-7-1-8-is-vulnerable-to-cross-site-scripting-e3e6c708df18"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/38xxx/CVE-2022-38845.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-38845"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/espocrm/espocrm","events":[{"introduced":"8ec6fa0f52aab91e9109bc91a7687929a858ff6d"},{"last_affected":"8ec6fa0f52aab91e9109bc91a7687929a858ff6d"}],"database_specific":{"extracted_events":[{"introduced":"7.1.8"},{"last_affected":"7.1.8"}],"source":"CPE_STRING","cpe":"cpe:2.3:a:espocrm:espocrm:7.1.8:*:*:*:*:*:*:*"}}],"versions":["7.1.8"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-38845.json"}}],"schema_version":"1.9.0"}