CVE-2024-49751: Frappe Press possible HTML injection through SaaS Signup inputs
Press, a Frappe custom app that runs Frappe Cloud, manages infrastructure, subscription, marketplace, and software-as-a-service (SaaS). Prior to commit 5d118a902872d7941f099ad1fb918e2421e79ccd, a user could inject HTML through SaaS signup inputs. The user who injected the unsafe HTML code would only affect themselves and would not affect other users. Commit 5d118a902872d7941f099ad1fb918e2421e79ccd patches this bug.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-49751?
CVE-2024-49751 is classified as a high severity vulnerability due to its potential for HTML injection, which can lead to various attacks such as XSS.
How do I fix CVE-2024-49751?
To mitigate CVE-2024-49751, update Frappe Press to a version after commit 5d118a902872d7941f099ad1fb918e2421e79ccd.
What types of attacks can CVE-2024-49751 enable?
CVE-2024-49751 enables attacks such as cross-site scripting (XSS), which can compromise user sessions and hijack user data.
Which versions of Frappe Press are affected by CVE-2024-49751?
CVE-2024-49751 affects all versions of Frappe Press prior to commit 5d118a902872d7941f099ad1fb918e2421e79ccd.
What components of Frappe Press are vulnerable due to CVE-2024-49751?
The vulnerability in CVE-2024-49751 is specifically related to the SaaS signup inputs that do not properly sanitize user input.