VULNERABILITY INTELLIGENCE

CVE-2022-23058

CVSS score3.5 NONE

EPSS probability0.85%

CISA KEVNot currently listed

Published2022-06-22

Last modified2026-06-17

CVSS vectorAV:N/AC:M/Au:S/C:N/I:P/A:N

Description

ERPNext in versions v12.0.9-v13.0.3 are affected by a stored XSS vulnerability that allows low privileged users to store malicious scripts in the ‘username’ field in ‘my settings’ which can lead to full account takeover.

Weakness classification

vulnerabilitylab@mend.io: CWE-79

Primary references

vulnerabilitylab@mend.io — Patch, Third Party Advisory
vulnerabilitylab@mend.io — Exploit, Patch, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108 — Patch, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108 — Exploit, Patch, Third Party Advisory