Lucene search

GitHub_MCVELIST:CVE-2023-46127

HistoryOct 23, 2023 - 2:29 p.m.

CVE-2023-46127 Frappe vulnerable to HTML injection by any Desk user

2023-10-2314:29:01

CWE-79

GitHub_M

www.cve.org

frappe

html injection

patched

version 14.49.0

mariadb

python

CVSS3

5.4

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

EPSS

0.001

Percentile

24.5%

JSON

Frappe is a full-stack web application framework that uses Python and MariaDB on the server side and an integrated client side library. A malicious Frappe user with desk access could create documents containing HTML payloads allowing HTML Injection. This vulnerability has been patched in version 14.49.0.

CNA Affected

[
  {
    "vendor": "frappe",
    "product": "frappe",
    "versions": [
      {
        "version": "< 14.49.0",
        "status": "affected"
      }
    ]
  }
]

References

github.com/frappe/frappe/commit/3dc5d2fcc7561dde181ba953009fe6e39d64e900

github.com/frappe/frappe/pull/22339

github.com/frappe/frappe/security/advisories/GHSA-j2w9-8xrr-7g98

CVSS3

5.4

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

EPSS

0.001

Percentile

24.5%

JSON

Related for CVELIST:CVE-2023-46127