PT-2020-10490 · Frappé Technologies · Erpnext

Published 2020-03-19 · Updated 2020-03-19 · CVE-2019-20514

Positive Technologies (AI Summary)

CVSS v3.1

7.4

High

Base vector

AC:L/AV:N/A:N/C:H/I:N/PR:N/S:C/UI:R

Name of the Vulnerable Software and Affected Versions ERPNext version 11.1.47

Description The issue allows reflected XSS via the PATH INFO to the address/ URI. This can be exploited by manipulating the PATH INFO variable in the request.

Recommendations For ERPNext version 11.1.47, consider restricting access to the vulnerable URI to minimize the risk of exploitation. As a temporary workaround, avoid using the PATH INFO variable in the affected address/ URI until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2019-20514

Affected Products

Erpnext

References · 4

• 🔥 https://netsparker.com/web-applications-advisories/ns-19-017-cross-site-scripting-in-erpnext · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-20514 · Security Note
• https://osv.dev/vulnerability/CVE-2019-20514 · Vendor Advisory
• https://t.me/cvenotify/1913 · Telegram Post