Unrated severityNVD Advisory· Published Jun 22, 2022· Updated Sep 17, 2024

ERPNext - Stored XSS leads to account takover

CVE-2022-23056

Description

In ERPNext, versions v13.0.0-beta.13 through v13.30.0 are vulnerable to Stored XSS at the Patient History page which allows a low privilege user to conduct an account takeover attack.

Affected products

Erpnext/Erpnextv5
Range: v13.0.0-beta.13

Patches

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

github.com/frappe/erpnext/blob/21a3ea462aaf319e466c067c2ec406eb9abe6ed3/erpnext/healthcare/page/patient_history/patient_history.jsmitrex_refsource_MISC
www.mend.io/vulnerability-database/CVE-2022-23056mitrex_refsource_MISC

News mentions

No linked articles in our index yet.

cvss	0.000
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000