CVE-2022-23057 ERPNext - Stored XSS in My Profile

2022-05-1800:00:00

CWE-79

Mend

www.cve.org

5.8 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

21.6%

JSON

In ERPNext, versions v12.0.9–v13.0.3 are vulnerable to Stored Cross-Site-Scripting (XSS), due to user input not being validated properly. A low privileged attacker could inject arbitrary code into input fields when editing his profile.

CNA Affected

[
  {
    "product": "frappe",
    "vendor": "frappe",
    "versions": [
      {
        "lessThan": "unspecified",
        "status": "affected",
        "version": "v12.0.9",
        "versionType": "custom"
      },
      {
        "lessThanOrEqual": "v13.0.3",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]