Code injection

2019-08-2718:15:00

PRIOn knowledge base

www.prio-n.com

6.2 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

43.3%

JSON

public/js/frappe/form/footer/timeline.js in Frappe Framework 12 through 12.0.8 does not escape HTML in the timeline and thus is affected by crafted “changed value of” text.

CPENameOperatorVersion
frappege12.0.0
frappele12.0.8

CPE	Name	Operator	Version
	frappe	ge	12.0.0
	frappe	le	12.0.8

References

github.com/frappe/frappe/pull/8262