CVE-2023-46127

Katalog CVE

CVSS 5.4 · Medium EPSS 37,0%

Kerentanan Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') pada frappe. Skor CVSS 3.1 5.4 (Medium) menurut NVD.

Deskripsi (NVD)

Frappe is a full-stack web application framework that uses Python and MariaDB on the server side and an integrated client side library. A malicious Frappe user with desk access could create documents containing HTML payloads allowing HTML Injection. This vulnerability has been patched in version 14.49.0.

Rincian

Terbit di NVD

23 Oktober 2023

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

5.4 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

EPSS (30 hari)

37,0% peluang dieksploitasi; lebih tinggi dari 98,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/frappe/frappe/security/advisories/GHSA-j2w9-8xrr-7g98 advisory vendor
• https://github.com/frappe/frappe/commit/3dc5d2fcc7561dde181ba953009fe6e39d64e900 patch
• https://github.com/frappe/frappe/pull/22339 release notes