Lucene search

GitHub_MVULNRICHMENT:CVE-2023-46127

HistoryOct 23, 2023 - 2:29 p.m.

CVE-2023-46127 Frappe vulnerable to HTML injection by any Desk user

2023-10-2314:29:01

CWE-79

GitHub_M

github.com

frappe

html injection

vulnerability

patched

version 14.49.0

CVSS3

5.4

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

EPSS

0.001

Percentile

24.5%

SSVC

Exploitation

none

Automatable

Technical Impact

partial

JSON

Frappe is a full-stack web application framework that uses Python and MariaDB on the server side and an integrated client side library. A malicious Frappe user with desk access could create documents containing HTML payloads allowing HTML Injection. This vulnerability has been patched in version 14.49.0.

References

github.com/frappe/frappe/commit/3dc5d2fcc7561dde181ba953009fe6e39d64e900

github.com/frappe/frappe/pull/22339

github.com/frappe/frappe/security/advisories/GHSA-j2w9-8xrr-7g98

CVSS3

5.4

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

EPSS

0.001

Percentile

24.5%

SSVC

Exploitation

none

Automatable

Technical Impact

partial

JSON

Related for VULNRICHMENT:CVE-2023-46127