CVE-2022-41712

2022-11-2500:00:00

Fluid Attacks

www.cve.org

frappe

version 14.10.0

remote access

EPSS

0.001

Percentile

37.4%

JSON

Frappe version 14.10.0 allows an external attacker to remotely obtain arbitrary local files. This is possible because the application does not correctly validate the information injected by the user in the import_file parameter.

CNA Affected

[
  {
    "vendor": "n/a",
    "product": "Frappe",
    "versions": [
      {
        "version": "14.10.0",
        "status": "affected"
      }
    ]
  }
]

References

fluidattacks.com/advisories/kiniza/

github.com/frappe/frappe/

EPSS

0.001

Percentile

37.4%

JSON

Related for CVELIST:CVE-2022-41712