Security readout for executives and security teams
Plain-English summary
CVE-2017-14712 is a stored XSS flaw in EPESI 1.8.2 rev20170830. A malicious value in the Tasks Phonecall Notes Title field could be saved and later run in another user’s browser. Sources do not provide CVSS, patch status, or evidence of active exploitation.
Executive priority
Treat as a targeted remediation item for any live EPESI 1.8.2 deployment. The risk is not KEV-level urgent from the supplied evidence, but stored XSS can affect user trust, sessions, and internal data access.
Technical view
The CVE describes persistent cross-site scripting in the Tasks Phonecall Notes Title parameter of EPESI 1.8.2 rev20170830. The source bundle references a public Exploit-DB entry, but provides no CWE, CVSS vector, affected CPE, authentication requirements, or fixed version.
Likely exposure
Exposure appears limited to organizations running EPESI 1.8.2 rev20170830 with the Tasks Phonecall Notes functionality available to users. The bundle does not identify other affected versions or products.
Exploitation context
A public exploit reference exists, so defenders should assume technical details are publicly available. CISA KEV is false in the bundle, and no cited source states active exploitation in the wild.
Researcher notes
Evidence is sparse. The CVE record names the vulnerable parameter and version, while references point to an EPESI forum issue and Exploit-DB listing. No official CVSS, affected CPE, patch version, or exploitation-in-the-wild evidence is included.
Mitigation direction
- Check EPESI vendor guidance for a fixed release or official remediation.
- Upgrade away from EPESI 1.8.2 rev20170830 if vendor guidance confirms a fix.
- Restrict access to Tasks Phonecall Notes to trusted users until remediated.
- Review stored task-note titles for unexpected script-like content.
- Use browser/session protections to reduce impact of stored XSS where possible.
Validation and detection
- Inventory EPESI deployments and confirm exact version or revision.
- Determine whether Tasks Phonecall Notes is enabled and user-accessible.
- Review vendor forum guidance and release notes for this specific issue.
- Test remediation in a controlled environment without using public exploit steps.
- Check application logs for unusual task-note title creation or edits.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2017-14712 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://forum.epesibim.com/d/4956-security-issue-multiple-stored-xss-in-epesi-version-1-8-2-rev20170830CVE reference · x_refsource_MISC
- 42950CVE reference · exploit, x_refsource_EXPLOIT-DB
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.