CVE-2024-58391: Frappe before 15.4.0 XSS via Printview Parameters
Frappe before 14.58.0 and 15.x before 15.4.0 contains a cross-site scripting vulnerability in printview because printview parameters are not escaped before being rendered. Remote attackers can craft a malicious printview URL that, when visited by a victim, injects HTML and executes script in the victim's browser session.
Affected Software
Event History
Frequently Asked Questions
Which deployments are affected?
Frappe versions before 14.58.0 are affected, as are 15.x versions before 15.4.0. The issue is in the printview functionality.
What does an attacker need to exploit this issue?
An attacker can remotely craft a malicious printview URL. Exploitation requires a victim to visit that URL, after which HTML and script can execute in the victim's browser session.
What is the practical impact of successful exploitation?
Successful exploitation allows script execution in the victim's browser session. The provided severity vector indicates low confidentiality impact and no stated integrity or availability impact.