Frappe · Press · CVE-2024-49751
Name of the Vulnerable Software and Affected Versions:
Press versions prior to commit 5d118a902872d7941f099ad1fb918e2421e79ccd
Description:
The issue allows a user to inject HTML through SaaS signup inputs, which could affect the user themselves but not other users.
Recommendations:
For versions prior to commit 5d118a902872d7941f099ad1fb918e2421e79ccd, update to a version that includes the patch commit 5d118a902872d7941f099ad1fb918e2421e79ccd to resolve the issue. As a temporary workaround, consider validating and sanitizing user input in SaaS signup fields to prevent HTML injection until the patch is applied.