Reflected XSS Vulnerability in ERPNext by Frappe Technologies
CVE-2019-20520

7.4HIGH

Key Information:

Vendor

Frappe

Status
Erpnext
Vendor
CVE Published:
19 March 2020

What is CVE-2019-20520?

A reflected XSS vulnerability exists in ERPNext version 11.1.47, which allows attackers to manipulate the PATH_INFO variable to inject malicious scripts via the api/method/ URI. This flaw can be exploited to execute unauthorized scripts in a user's browser, potentially leading to session hijacking or data theft. It is important for users to address this vulnerability by updating to the latest version and following security best practices.

References

https://www.netsparker.com/web-applications-advisories/ns...
x_refsource_MISC

CVSS V3.1

Score:
7.4
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.