Frappe is a full-stack web application framework that uses Python and MariaDB on the server side and a tightly integrated client side library. Prior to versions 14.59.0 and 15.5.0, portal pages are susceptible to Cross-Site Scripting (XSS) which can be used to inject malicious JS code if user clicks on a malicious link. This vulnerability has been patched in versions 14.59.0 and 15.5.0. No known workarounds are available.
References
Link | Resource |
---|---|
https://github.com/frappe/frappe/releases/tag/v14.59.0 | Release Notes |
https://github.com/frappe/frappe/releases/tag/v15.5.0 | Release Notes |
https://github.com/frappe/frappe/security/advisories/GHSA-7p3m-h76m-hg9v | Vendor Advisory |
History
No history.
MITRE Information
Status: PUBLISHED
Assigner: GitHub_M
Published: 2024-02-07T15:03:29.677Z
Updated: 2024-06-04T17:43:12.686Z
Reserved: 2024-01-31T16:28:17.941Z
Link: CVE-2024-24812
JSON object: View
NVD Information
Status : Analyzed
Published: 2024-02-07T15:15:08.703
Modified: 2024-02-14T20:22:02.537
Link: CVE-2024-24812
JSON object: View
Redhat Information
No data.