PT-2023-29860 · Frappe · Frappe

Cogk · Publicado 2023-10-23 · Atualizado 2023-10-31 · CVE-2023-46127

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Frappe versions prior to 14.49.0

Description Frappe is a full-stack web application framework that uses Python and MariaDB on the server side and an integrated client side library. A malicious Frappe user with desk access could create documents containing HTML payloads allowing HTML Injection.

Recommendations For versions prior to 14.49.0, update to version 14.49.0 to resolve the issue. As a temporary workaround, consider restricting access to document creation for malicious users until the patch is applied.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2023-46127

GHSA-J2W9-8XRR-7G98

Produtos afetados

Frappe

Referências · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/46xxx/CVE-2023-46127.json · Exploit
• https://github.com/frappe/frappe/commit/3dc5d2fcc7561dde181ba953009fe6e39d64e900 · Correção
• https://github.com/frappe/frappe/security/advisories/GHSA-j2w9-8xrr-7g98 · Aviso do Fabricante
• https://github.com/frappe/frappe/pull/22339 · Nota
• https://osv.dev/vulnerability/CVE-2023-46127 · Aviso do Fabricante
• https://twitter.com/VulmonFeeds/status/1716493804704796764 · Publicação no Twitter
• https://t.me/cibsecurity/72775 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-46127 · Nota de Segurança
• https://twitter.com/CVEnew/status/1716465035600433365 · Publicação no Twitter