CVE-2023-54408: Frappe before 14.31.0 HTML Injection via Weak Escaping
Frappe before 13.52.0 and 14.x before 14.31.0 contains an HTML injection vulnerability caused by weak escaping of user-supplied content rendered in pages. Attackers can submit crafted HTML that bypasses the insufficient escaping and is rendered in the browsers of users who view it, enabling cross-site scripting.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Frappeto a version that resolves this vulnerability.Fixed in 13.52.0 - Upgrade
Upgrade
Frappeto a version that resolves this vulnerability.Fixed in 14.31.0
Event History
Frequently Asked Questions
Which Frappe versions are affected?
Frappe versions before 13.52.0 are affected, as are 14.x versions before 14.31.0.
What must an attacker do to exploit this issue?
An attacker must be able to submit crafted HTML as user-supplied content. The payload is triggered when another user views a page that renders that content.
Are users exposed merely by visiting an affected Frappe site?
No. Exploitation requires user interaction: a user must view a page containing the attacker-supplied content. The vulnerability can then enable cross-site scripting in that user's browser.