CVE-2023-46127CWE-79

Frappe vulnerable to HTML injection by any Desk user

Medium · published October 23, 2023

CVSS v3.1

5.4

EPSS

37%

Percentile

98.5

In the wild

Unconfirmed

What it is

Frappe is a full-stack web application framework that uses Python and MariaDB on the server side and an integrated client side library. A malicious Frappe user with desk access could create documents containing HTML payloads allowing HTML Injection. This vulnerability has been patched in version 14.49.0.

The record

Technical detail

CVSS v3.1: 5.4 · MEDIUM
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
CVSS v4.0: Not supplied
EPSS: 0.36979 · 98.5th percentile
Weakness: CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published: 2023-10-23T14:29Z

EPSS history

Timeline

23 OCT 14:29Z
Frappe vulnerable to HTML injection by any Desk user
cvelistv5