Cross site scripting

2022-06-2208:15:00

PRIOn knowledge base

www.prio-n.com

5.5 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

13.0%

JSON

ERPNext in versions v12.0.9-v13.0.3 are affected by a stored XSS vulnerability that allows low privileged users to store malicious scripts in the ‘username’ field in ‘my settings’ which can lead to full account takeover.

CPENameOperatorVersion
erpnextge12.0.9
erpnextlt13.1.0

CPE	Name	Operator	Version
	erpnext	ge	12.0.9
	erpnext	lt	13.1.0

References

github.com/frappe/frappe/commit/497ea861f481c6a3c52fe2aed9d0df1b6c99e9d7

www.mend.io/vulnerability-database/CVE-2022-23058