XSS in Frappe Erpnext
CVE-2022-23058
ERPNext in versions v12.0.9-v13.0.3 are affected by a stored XSS vulnerability that allows low privileged users to store malicious scripts in the ‘username’ field in ‘my settings’ which can lead to full account takeover.
Vulnerability class: XSS (Cross-Site Scripting)
EPSS: 0.008 (53.2th percentile) — read the EPSS interpretation.
Affected products
- Frappe Erpnext
- Frappe — versions v12.0.9, unspecified
Weakness classification (CWE)
References
- vulnerabilitylab@mend.io (Patch, Third Party Advisory, x_refsource_MISC)
- vulnerabilitylab@mend.io (Exploit, Patch, Third Party Advisory, x_refsource_MISC)