CVE-2022-23056

2022-06-2208:15:07

CWE-79

[email protected]

web.nvd.nist.gov

erpnext

v13

stored xss

patient history

account takeover

CVSS2

3.5

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:S/C:N/I:P/A:N

EPSS

Percentile

12.8%

JSON

In ERPNext, versions v13.0.0-beta.13 through v13.30.0 are vulnerable to Stored XSS at the Patient History page which allows a low privilege user to conduct an account takeover attack.

Affected configurations

Nvd

Node

frappeerpnextRange13.0.1–13.30.0

frappeerpnextMatch13.0.0beta13

frappeerpnextMatch13.0.0beta14

VendorProductVersionCPE
frappeerpnext*cpe:2.3:a:frappe:erpnext:*:*:*:*:*:*:*:*
frappeerpnext13.0.0cpe:2.3:a:frappe:erpnext:13.0.0:beta13:*:*:*:*:*:*
frappeerpnext13.0.0cpe:2.3:a:frappe:erpnext:13.0.0:beta14:*:*:*:*:*:*

Vendor	Product	Version	CPE
frappe	erpnext	*	cpe:2.3:a:frappe:erpnext::::::::
frappe	erpnext	13.0.0	cpe:2.3:a:frappe:erpnext:13.0.0:beta13::::::
frappe	erpnext	13.0.0	cpe:2.3:a:frappe:erpnext:13.0.0:beta14::::::