Security readout for executives and security teams
Plain-English summary
EPESI 1.8.2 rev20170830 can store malicious script content in a task description. If another user views that task, the script may run in their browser. Business risk depends on who can create tasks and what privileges viewers have inside EPESI.
Executive priority
Treat this as a targeted application hygiene issue. It is not marked as known exploited, but public exploit information exists and stored XSS can expose sessions or data when privileged users view affected tasks.
Technical view
The CVE describes stored cross-site scripting in the Tasks Description parameter of EPESI 1.8.2 rev20170830. The provided references include the original EPESI forum report and an Exploit-DB entry. No CVSS, CWE, vendor advisory details, or confirmed fixed version are provided in the source bundle.
Likely exposure
Exposure is most likely in organizations still running EPESI 1.8.2 rev20170830 where untrusted or lower-privileged users can create or edit task descriptions viewed by other users.
Exploitation context
CISA KEV status is false in the supplied data. Exploit-DB is listed as a public exploit reference, but the provided sources do not establish active exploitation in the wild.
Researcher notes
Evidence is sparse: the CVE record names the vulnerable parameter and version, while the references point to a forum disclosure and Exploit-DB. The bundle does not provide scoring, patch status, affected CPEs, or exploitation telemetry.
Mitigation direction
- Inventory EPESI deployments and confirm whether version 1.8.2 rev20170830 is present.
- Check EPESI vendor or maintainer guidance for fixed versions or official remediation.
- Restrict task creation and editing to trusted users until remediation is confirmed.
- Review custom controls for safe output encoding of task descriptions.
- Prioritize upgrade or replacement if the EPESI instance is internet-accessible.
Validation and detection
- Verify the EPESI version shown by the deployed application or package metadata.
- Confirm whether the Tasks module is enabled and used by multiple roles.
- Review permissions for users who can create or edit task descriptions.
- Inspect recent task descriptions for suspicious embedded script-like content.
- Use a safe, non-executing XSS test string in a controlled environment only.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2017-14717 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://forum.epesibim.com/d/4956-security-issue-multiple-stored-xss-in-epesi-version-1-8-2-rev20170830CVE reference · x_refsource_MISC
- 42950CVE reference · exploit, x_refsource_EXPLOIT-DB
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.