Lucene search

[email protected]CVE-2022-23056

HistoryJun 22, 2022 - 8:15 a.m.

CVE-2022-23056

2022-06-2208:15:00

CWE-79

[email protected]

web.nvd.nist.gov

erpnext

vulnerability

cve-2022-23056

stored xss

account takeover

nvd

3.5 Low

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:S/C:N/I:P/A:N

0.0004 Low

EPSS

Percentile

11.9%

JSON

In ERPNext, versions v13.0.0-beta.13 through v13.30.0 are vulnerable to Stored XSS at the Patient History page which allows a low privilege user to conduct an account takeover attack.

CPENameOperatorVersion
frappe:erpnextfrappe erpnextlt13.30.0
frappe:erpnextfrappe erpnexteq13.0.0

CPE	Name	Operator	Version
frappe:erpnext	frappe erpnext	lt	13.30.0
frappe:erpnext	frappe erpnext	eq	13.0.0

References

github.com/frappe/erpnext/blob/21a3ea462aaf319e466c067c2ec406eb9abe6ed3/erpnext/healthcare/page/patient_history/patient_history.js#L288

www.mend.io/vulnerability-database/CVE-2022-23056

Social References

3.5 Low

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:S/C:N/I:P/A:N

0.0004 Low

EPSS

Percentile

11.9%

JSON

Related for CVE-2022-23056

prion1 osv1