Description
Frappe ERPNext before 15.119.1 and 16.x before 16.32.0 contains a stored cross-site scripting vulnerability because content submitted through a public-facing booking page is stored without neutralization. Unauthenticated attackers can submit crafted content that is rendered as raw HTML in a privileged user's session, executing script to act as that user and take over the account.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| frappe | erpnext | < 15.119.1, 16.0.0-beta.1 – < 16.32.0 | 15.119.1 |
References
- GitHub Security Advisory (GHSA-rv4r-c8v3-3hrc) vendor-advisory
- VulnCheck Advisory: Frappe ERPNext before 15.119.1 Stored XSS via Public Booking Page third-party-advisory