XSS in Erpnext
CVE-2022-23056
In ERPNext, versions v13.0.0-beta.13 through v13.30.0 are vulnerable to Stored XSS at the Patient History page which allows a low privilege user to conduct an account takeover attack.
Vulnerability class: XSS (Cross-Site Scripting)
EPSS: 0.008 (53.2th percentile) — read the EPSS interpretation.
Affected products
- Erpnext — versions v13.0.0-beta.13, unspecified
- Frappe Erpnext — versions 13.0.0
Weakness classification (CWE)
References
- vulnerabilitylab@mend.io (Exploit, Patch, Third Party Advisory, x_refsource_MISC)
- vulnerabilitylab@mend.io (Patch, Third Party Advisory, x_refsource_MISC)