Executive brief
Frappe is an open-source web framework used to build business applications. A cross-site scripting (XSS) vulnerability in Frappe allows attackers to inject malicious code into blog and exception pages when a user clicks on a specially crafted link, potentially stealing session data or performing unauthorized actions on behalf of the victim.
Technical details
The vulnerability is a reflected XSS flaw affecting Frappe versions before 14.49.0, where user-supplied input in the request URL is not properly sanitized before being rendered on blog and exception pages. An attacker can craft a malicious URL containing HTML/JavaScript payload that executes in the victim's browser context when clicked. The attack requires user interaction (victim must click the link) and does not require authentication. The impact is limited to standard XSS effects such as session hijacking, credential theft, or malware distribution. The vulnerability is patched in Frappe version 14.49.0 and later.
Affected products
- Frappe Frappe before 14.49.0
Timeline
- 2023-12-11: disclosed
- 2023-12-11: patched: Fixed in version 14.49.0