Cross-Site Scripting Vulnerability in Frappe ERPNext by Frappe Technologies
CVE-2022-28598

6.1MEDIUM

Key Information:

Vendor

Frappe

Status
Erpnext
Vendor
CVE Published:
22 August 2022

Badges

👾 Exploit Exists🟡 Public PoC🟣 EPSS 13%

What is CVE-2022-28598?

Frappe ERPNext version 12.29.0 contains a vulnerability that allows attackers to exploit weaknesses in user input handling. The software fails to properly sanitize or neutralize user-provided input before rendering it on web pages. This can allow malicious content to be injected and subsequently executed in the browsers of other users, leading to potential data theft, session hijacking, or further attacks against unsuspecting users. The vulnerability underscores the importance of robust input validation and output encoding in web applications.

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2022-28598
Created by patrickdeanramos

References

http://erpnext.com
http://frappe.com
https://github.com/patrickdeanramos/CVE-2022-28598/blob/m...

EPSS Score

13% chance of being exploited in the next 30 days.

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability Reserved

JSON
.