Vulnerability Report

CVE-2022-23056

Title: Stored XSS at Patient History page leading to account takeover

Stored XSS, Account Takeover

Proof Of Concept

No public PoC currently indexed for CVE-2022-23056.

CWE Category CWE-79

Published Date Jun 22, 2022

Modified Date Nov 21, 2024

Exploit Status Not Found

Score 3.5 CVSS v2.0

Exploit Probability (EPSS)

0.81%

Vulnerability Summary

CVE-2022-23056: In ERPNext, versions v13.0.0-beta.13 through v13.30.0 are vulnerable to Stored XSS at the Patient History page which allows a low privilege user to conduct an account takeover attack.

Impacted Vendors

frappe 1

erpnext 1

Reference Links

https://github.com/frappe/erpnext/blob/21a3ea462aaf319e466c067c2ec406eb9abe6ed3/erpnext/healthcare/page/patient_history/patient_history.js#L288 https://www.mend.io/vulnerability-database/CVE-2022-23056 https://github.com/frappe/erpnext/blob/21a3ea462aaf319e466c067c2ec406eb9abe6ed3/erpnext/healthcare/page/patient_history/patient_history.js#L288 https://www.mend.io/vulnerability-database/CVE-2022-23056

CVSS v2.0

Source Entity [email protected]

Severity LOW

3.5

Access Vector

N/A

Authentication

N/A

RAW VECTOR AV:N/AC:M/Au:S/C:N/I:P/A:N

Associated Attack Patterns (CAPEC)

Total: Patterns

CVE-2022-23056 Exploits & PoCs (Proof Of Concept)

No public PoCs found in our database for this CVE.

November 21, 2024 MODIFIED

Vulnerability data or affected products updated.

June 22, 2022 PUBLISHED

Vulnerability first announced in NVD.

Attack Vector Matrix

Access Vector N/A

Complexity N/A

Privileges N/A

Interaction NONE

CVSS Vector String


                                    AV:N/AC:M/Au:S/C:N/I:P/A:N

Affected Stack

No specific products linked.