Security readout for executives and security teams
Plain-English summary
This CVE describes a stored cross-site scripting flaw in EPESI 1.8.2 rev20170830. Malicious script content could be saved in the Phonecalls Description field and later run in another user's browser when viewed. Business risk depends on whether that exact EPESI version or related vulnerable build is still used.
Executive priority
Prioritize review if EPESI is still in production, especially if exposed to many users or the internet. The issue is old and not KEV-listed, but stored XSS can still create account and data-access risk in legacy CRM systems.
Technical view
The public record identifies stored XSS in the Phonecalls Description parameter of EPESI 1.8.2 rev20170830. The bundle does not provide CVSS, CWE, affected CPEs, authentication requirements, patch details, or proof of exploitation. Treat exposure analysis as version-and-feature dependent.
Likely exposure
Organizations are likely exposed only if they still run EPESI 1.8.2 rev20170830 and use the Phonecalls module. Internet-facing or broadly accessible CRM instances increase impact because stored XSS can affect users who view saved records.
Exploitation context
The source bundle does not show CISA KEV listing or any cited evidence of active exploitation. It reports the vulnerable parameter and stored XSS class only. Exploitability details and prerequisites are incomplete in the provided sources.
Researcher notes
The available evidence is sparse: one CVE description and a forum reference. No CVSS vector, CWE, CPE, patch, or exploit status is provided. Avoid broad product claims beyond EPESI 1.8.2 rev20170830 and the Phonecalls Description parameter.
Mitigation direction
- Inventory EPESI deployments and identify any 1.8.2 rev20170830 instances.
- Check EPESI vendor or project guidance for fixed versions or official mitigations.
- Restrict access to EPESI until remediation is confirmed.
- Review Phonecalls Description content for suspicious script-like entries.
- Apply output encoding and input validation if maintaining custom EPESI code.
Validation and detection
- Confirm deployed EPESI version and revision from administrative or package records.
- Verify whether the Phonecalls module is enabled and used.
- Review historical records in Phonecalls Description for unexpected markup or scripts.
- Check application logs for suspicious edits to phonecall records.
- Perform safe authenticated testing in a controlled environment without weaponized payloads.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2017-14713 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://forum.epesibim.com/d/4956-security-issue-multiple-stored-xss-in-epesi-version-1-8-2-rev20170830CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.