Описание
ERPNext in versions v12.0.9-v13.0.3 are affected by a stored XSS vulnerability that allows low privileged users to store malicious scripts in the ‘username’ field in ‘my settings’ which can lead to full account takeover.
Ссылки
- PatchThird Party Advisory
- ExploitPatchThird Party Advisory
- PatchThird Party Advisory
- ExploitPatchThird Party Advisory
Уязвимые конфигурации
Конфигурация 1Версия от 12.0.9 (включая) до 13.1.0 (исключая)
cpe:2.3:a:frappe:erpnext:*:*:*:*:*:*:*:*
EPSS
Процентиль: 47%
0.00238
Низкий
3.5 Low
CVSS2
Дефекты
CWE-79
Связанные уязвимости
CVSS3: 5.4
github
больше 3 лет назад
ERPNext in versions v12.0.9-v13.0.3 are affected by a stored XSS vulnerability that allows low privileged users to store malicious scripts in the ‘username’ field in ‘my settings’ which can lead to full account takeover.
EPSS
Процентиль: 47%
0.00238
Низкий
3.5 Low
CVSS2
Дефекты
CWE-79