CVE-2022-23056 ERPNext - Stored XSS leads to account takover

2022-06-2207:25:16

CWE-79

Mend

www.cve.org

erpnext

stored xss

account takeover

vulnerable version

AI Score

5.8

Confidence

High

EPSS

Percentile

12.8%

JSON

In ERPNext, versions v13.0.0-beta.13 through v13.30.0 are vulnerable to Stored XSS at the Patient History page which allows a low privilege user to conduct an account takeover attack.

CNA Affected

[
  {
    "product": "erpnext",
    "vendor": "erpnext",
    "versions": [
      {
        "lessThan": "unspecified",
        "status": "affected",
        "version": "v13.0.0-beta.13",
        "versionType": "custom"
      },
      {
        "lessThanOrEqual": "v13.30.0",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]