CVE-2022-23058 ERPNext - Stored XSS in My Settings

2022-06-2207:30:21

CWE-79

Mend

www.cve.org

erpnext

vulnerability

my settings

stored xss

account takeover

AI Score

5.5

Confidence

High

EPSS

Percentile

12.8%

JSON

ERPNext in versions v12.0.9-v13.0.3 are affected by a stored XSS vulnerability that allows low privileged users to store malicious scripts in the ‘username’ field in ‘my settings’ which can lead to full account takeover.

CNA Affected

[
  {
    "product": "frappe",
    "vendor": "frappe",
    "versions": [
      {
        "lessThan": "unspecified",
        "status": "affected",
        "version": "v12.0.9",
        "versionType": "custom"
      },
      {
        "lessThanOrEqual": "v13.0.3",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]