Lucene search

PRIOn knowledge basePRION:CVE-2022-23056

HistoryJun 22, 2022 - 8:15 a.m.

Design/Logic Flaw

2022-06-2208:15:00

PRIOn knowledge base

www.prio-n.com

5.9 Medium

AI Score

Confidence

High

3.5 Low

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:S/C:N/I:P/A:N

0.0004 Low

EPSS

Percentile

10.9%

JSON

In ERPNext, versions v13.0.0-beta.13 through v13.30.0 are vulnerable to Stored XSS at the Patient History page which allows a low privilege user to conduct an account takeover attack.

CPENameOperatorVersion
erpnextge13.0.1
erpnextlt13.30.0
erpnexteq13.0.0 beta14
erpnexteq13.0.0 beta13

Name	Operator	Version
erpnext	ge	13.0.1
erpnext	lt	13.30.0
erpnext	eq	13.0.0 beta14
erpnext	eq	13.0.0 beta13

References

github.com/frappe/erpnext/blob/21a3ea462aaf319e466c067c2ec406eb9abe6ed3/erpnext/healthcare/page/patient_history/patient_history.js

www.mend.io/vulnerability-database/CVE-2022-23056

5.9 Medium

AI Score

Confidence

High

3.5 Low

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:S/C:N/I:P/A:N

0.0004 Low

EPSS

Percentile

10.9%

JSON

Related for PRION:CVE-2022-23056