CVE-2022-41712: Path Traversal
Published Nov 25, 2022
·Updated
Frappe version 14.10.0 allows an external attacker to remotely obtain arbitrary local files. This is possible because the application does not correctly validate the information injected by the user in the importfile parameter.
Affected Software
1 affected component
Frappe frappe=14.10.0
Event History
Nov 25, 2022
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
DescriptionWeakness
Data Sourced
via NVD·06:15 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the vulnerability ID for the Frappe version 14.10.0 vulnerability?
The vulnerability ID for the Frappe version 14.10.0 vulnerability is CVE-2022-41712.
2
What is the severity of CVE-2022-41712?
The severity of CVE-2022-41712 is medium (6.5).
3
How does the Frappe version 14.10.0 vulnerability occur?
The Frappe version 14.10.0 vulnerability occurs because the application does not correctly validate the information injected by the user in the import_file parameter.
4
What software is affected by CVE-2022-41712?
The Frappe version 14.10.0 software is affected by CVE-2022-41712.
5
How can I fix the Frappe version 14.10.0 vulnerability?
To fix the Frappe version 14.10.0 vulnerability, update to a version of Frappe that contains the necessary security patches.