PT-2022-15817 · Erpnext · Erpnext

Published 2022-06-22 · Updated 2022-07-05 · CVE-2022-23057

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions ERPNext versions v12.0.9 through v13.0.3

Description The issue is related to Stored Cross-Site-Scripting (XSS) due to improper validation of user input. This allows a low-privileged attacker to inject arbitrary code into input fields when editing their profile.

Recommendations For ERPNext versions v12.0.9 through v13.0.3, consider validating user input properly to prevent arbitrary code injection. As a temporary workaround, restrict access to profile editing features for low-privileged users until a proper fix is applied.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2022-23057

Affected Products

Erpnext

References · 6

• 🔥 https://mend.io/vulnerability-database/CVE-2022-23057 · Exploit
• https://github.com/frappe/frappe/commit/497ea861f481c6a3c52fe2aed9d0df1b6c99e9d7 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-23057 · Security Note
• https://osv.dev/vulnerability/CVE-2022-23057 · Vendor Advisory
• https://t.me/cvenotify/31987 · Telegram Post
• https://t.me/cvenotify/32610 · Telegram Post