5.4

CVE-2023-46127

Frappe vulnerable to HTML injection by any Desk user

Frappe is a full-stack web application framework that uses Python and MariaDB on the server side and an integrated client side library. A malicious Frappe user with desk access could create documents containing HTML payloads allowing HTML Injection. This vulnerability has been patched in version 14.49.0.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Frappe ≫ Frappe Version < 14.49.0
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 36.98% 0.983
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 5.4 2.3 2.7
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
security-advisories@github.com 5.4 2.8 2.5
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

https://github.com/frappe/frappe/commit/3dc5d2fcc7561dde181ba953009fe6e39d64e900
Patch
https://github.com/frappe/frappe/pull/22339
Release Notes
https://github.com/frappe/frappe/security/advisories/GHSA-j2w9-8xrr-7g98
Vendor Advisory