CVE-2019-15700

2019-08-2718:15:11

Google

osv.dev

6.7 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

43.3%

JSON

public/js/frappe/form/footer/timeline.js in Frappe Framework 12 through 12.0.8 does not escape HTML in the timeline and thus is affected by crafted “changed value of” text.

CPENameOperatorVersion
frappeeq12.0.4
frappeeq12.0.5
frappeeq12.0.2
frappeeq12.0.3
frappeeq12.0.0
frappeeq12.0.8
frappeeq12.0.7
frappeeq12.0.6
frappeeq12.0.1