PT-2019-13899 · Frappe · Frappe Framework

Publicado 2019-08-12 · Atualizado 2020-08-24 · CVE-2019-14965

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Frappe Framework versions 10 through 12 before 12.0.4

Description A server-side template injection issue exists. This issue allows for the injection of templates on the server side, potentially leading to unauthorized access or data manipulation.

Recommendations For Frappe Framework versions 10 through 12 before 12.0.4, update to version 12.0.4 or later to resolve the issue.

Correção

Code Injection

Enumeração de Fraquezas

CWE-94

Identificadores relacionados

CVE-2019-14965

Produtos afetados

Frappe Framework

Referências · 8

• https://github.com/frappe/frappe/releases/tag/v12.0.4 · Nota
• https://github.com/frappe/frappe/compare/v12.0.3...v12.0.4 · Correção
• https://github.com/frappe/frappe/pull/8046 · Nota
• https://github.com/frappe/frappe/pull/8044 · Correção
• https://github.com/frappe/frappe/pull/8045 · Correção
• https://github.com/frappe/frappe/pull/8047 · Correção
• https://osv.dev/vulnerability/CVE-2019-14965 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-14965 · Nota de Segurança