PT-2023-29860 · Frappe · Frappe

Cogk · Published 2023-10-23 · Updated 2023-10-31 · CVE-2023-46127

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Frappe versions prior to 14.49.0

Description Frappe is a full-stack web application framework that uses Python and MariaDB on the server side and an integrated client side library. A malicious Frappe user with desk access could create documents containing HTML payloads allowing HTML Injection.

Recommendations For versions prior to 14.49.0, update to version 14.49.0 to resolve the issue. As a temporary workaround, consider restricting access to document creation for malicious users until the patch is applied.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2023-46127

GHSA-J2W9-8XRR-7G98

Affected Products

Frappe

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/46xxx/CVE-2023-46127.json · Exploit
• https://github.com/frappe/frappe/commit/3dc5d2fcc7561dde181ba953009fe6e39d64e900 · Patch
• https://github.com/frappe/frappe/security/advisories/GHSA-j2w9-8xrr-7g98 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-46127 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-46127 · Security Note
• https://github.com/frappe/frappe/pull/22339 · Note
• https://twitter.com/VulmonFeeds/status/1716493804704796764 · Twitter Post
• https://t.me/cibsecurity/72775 · Telegram Post
• https://twitter.com/CVEnew/status/1716465035600433365 · Twitter Post