Lucene search
HistoryNov 25, 2022 - 6:15 p.m.
CVE-2022-41712
frappe
version 14.10.0
external attacker
remote obtain
arbitrary local files
information validation
CVSS3
6.5
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
EPSS
0.001
Percentile
37.4%
Frappe version 14.10.0 allows an external attacker to remotely obtain arbitrary local files. This is possible because the application does not correctly validate the information injected by the user in the import_file parameter.
Affected configurations
Node
frappefrappeMatch14.10.0
Related
prion
prion
Design/Logic Flaw
2022-11-25 18:15:00
cve
cve
CVE-2022-41712
2022-11-25 18:15:11
cvelist
cvelist
CVE-2022-41712
2022-11-25 00:00:00
osv
osv
CVE-2022-41712
2022-11-25 18:15:11
CVSS3
6.5
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
EPSS
0.001
Percentile
37.4%
Related for NVD:CVE-2022-41712