CVE-2024-24812 - Vulnerability Details - OpenCVE

Frappe is a full-stack web application framework that uses Python and MariaDB on the server side and a tightly integrated client side library. Prior to versions 14.59.0 and 15.5.0, portal pages are susceptible to Cross-Site Scripting (XSS) which can be used to inject malicious JS code if user clicks on a malicious link. This vulnerability has been patched in versions 14.59.0 and 15.5.0. No known workarounds are available.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00445.

Key SSVC decision points have not yet been added.

Vendors	Products
Frappe	Frappe

Configuration 1 [-]

OR	cpe:2.3:a:frappe:frappe::::::::
	cpe:2.3:a:frappe:frappe::::::::

No data.

No data.

Advisories

Source	ID	Title
EUVD	EUVD-2024-22184	Frappe is a full-stack web application framework that uses Python and MariaDB on the server side and a tightly integrated client side library. Prior to versions 14.59.0 and 15.5.0, portal pages are susceptible to Cross-Site Scripting (XSS) which can be used to inject malicious JS code if user clicks on a malicious link. This vulnerability has been patched in versions 14.59.0 and 15.5.0. No known workarounds are available.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References

Link	Providers
https://github.com/frappe/frappe/releases/tag/v14.59.0
https://github.com/frappe/frappe/releases/tag/v15.5.0
https://github.com/frappe/frappe/security/advisories/GHSA-7p3m-h76m-hg9v

History

No history.

MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published: 2024-02-07T15:03:29.677Z

Updated: 2024-08-01T23:28:12.777Z

Reserved: 2024-01-31T16:28:17.941Z

Link: CVE-2024-24812

Vulnrichment

Updated: 2024-08-01T23:28:12.777Z

NVD

Status : Modified

Published: 2024-02-07T15:15:08.703

Modified: 2024-11-21T08:59:45.950

Link: CVE-2024-24812

Redhat

No data.

OpenCVE Enrichment

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-24812", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2024-01-31T16:28:17.941Z", "datePublished": "2024-02-07T15:03:29.677Z", "dateUpdated": "2024-08-01T23:28:12.777Z"}, "containers": {"cna": {"title": "Frappe Authenticated Reflected Cross site scripting (XSS) in portal pages", "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "lang": "en", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-80", "lang": "en", "description": "CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/frappe/frappe/security/advisories/GHSA-7p3m-h76m-hg9v", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/frappe/frappe/security/advisories/GHSA-7p3m-h76m-hg9v"}, {"name": "https://github.com/frappe/frappe/releases/tag/v14.59.0", "tags": ["x_refsource_MISC"], "url": "https://github.com/frappe/frappe/releases/tag/v14.59.0"}, {"name": "https://github.com/frappe/frappe/releases/tag/v15.5.0", "tags": ["x_refsource_MISC"], "url": "https://github.com/frappe/frappe/releases/tag/v15.5.0"}], "affected": [{"vendor": "frappe", "product": "frappe", "versions": [{"version": "< 14.59.0", "status": "affected"}, {"version": ">= 15.0.0, < 15.5.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2024-02-07T15:03:29.677Z"}, "descriptions": [{"lang": "en", "value": "Frappe is a full-stack web application framework that uses Python and MariaDB on the server side and a tightly integrated client side library. Prior to versions 14.59.0 and 15.5.0, portal pages are susceptible to Cross-Site Scripting (XSS) which can be used to inject malicious JS code if user clicks on a malicious link. This vulnerability has been patched in versions 14.59.0 and 15.5.0. No known workarounds are available."}], "source": {"advisory": "GHSA-7p3m-h76m-hg9v", "discovery": "UNKNOWN"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-24812", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-03-07T18:43:06.695783Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-04T17:43:12.686Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T23:28:12.777Z"}, "title": "CVE Program Container", "references": [{"name": "https://github.com/frappe/frappe/security/advisories/GHSA-7p3m-h76m-hg9v", "tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://github.com/frappe/frappe/security/advisories/GHSA-7p3m-h76m-hg9v"}, {"name": "https://github.com/frappe/frappe/releases/tag/v14.59.0", "tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/frappe/frappe/releases/tag/v14.59.0"}, {"name": "https://github.com/frappe/frappe/releases/tag/v15.5.0", "tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/frappe/frappe/releases/tag/v15.5.0"}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://github.com/frappe/frappe/security/advisories/GHSA-7p3m-h76m-hg9v", "name": "https://github.com/frappe/frappe/security/advisories/GHSA-7p3m-h76m-hg9v", "tags": ["x_refsource_CONFIRM", "x_transferred"]}, {"url": "https://github.com/frappe/frappe/releases/tag/v14.59.0", "name": "https://github.com/frappe/frappe/releases/tag/v14.59.0", "tags": ["x_refsource_MISC", "x_transferred"]}, {"url": "https://github.com/frappe/frappe/releases/tag/v15.5.0", "name": "https://github.com/frappe/frappe/releases/tag/v15.5.0", "tags": ["x_refsource_MISC", "x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T23:28:12.777Z"}}, {"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-24812", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-03-07T18:43:06.695783Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-05-23T19:01:16.407Z"}, "title": "CISA ADP Vulnrichment"}], "cna": {"title": "Frappe Authenticated Reflected Cross site scripting (XSS) in portal pages", "source": {"advisory": "GHSA-7p3m-h76m-hg9v", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "frappe", "product": "frappe", "versions": [{"status": "affected", "version": "< 14.59.0"}, {"status": "affected", "version": ">= 15.0.0, < 15.5.0"}]}], "references": [{"url": "https://github.com/frappe/frappe/security/advisories/GHSA-7p3m-h76m-hg9v", "name": "https://github.com/frappe/frappe/security/advisories/GHSA-7p3m-h76m-hg9v", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/frappe/frappe/releases/tag/v14.59.0", "name": "https://github.com/frappe/frappe/releases/tag/v14.59.0", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/frappe/frappe/releases/tag/v15.5.0", "name": "https://github.com/frappe/frappe/releases/tag/v15.5.0", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Frappe is a full-stack web application framework that uses Python and MariaDB on the server side and a tightly integrated client side library. Prior to versions 14.59.0 and 15.5.0, portal pages are susceptible to Cross-Site Scripting (XSS) which can be used to inject malicious JS code if user clicks on a malicious link. This vulnerability has been patched in versions 14.59.0 and 15.5.0. No known workarounds are available."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-80", "description": "CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2024-02-07T15:03:29.677Z"}}}, "cveMetadata": {"cveId": "CVE-2024-24812", "state": "PUBLISHED", "dateUpdated": "2024-08-01T23:28:12.777Z", "dateReserved": "2024-01-31T16:28:17.941Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2024-02-07T15:03:29.677Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:frappe:frappe:*:*:*:*:*:*:*:*", "matchCriteriaId": "81278517-B286-4C42-8320-A19A817D1705", "versionEndExcluding": "14.59.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:frappe:frappe:*:*:*:*:*:*:*:*", "matchCriteriaId": "88151956-39A0-4C8E-8025-DCE54D8AE90B", "versionEndExcluding": "15.5.0", "versionStartIncluding": "15.0.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "Frappe is a full-stack web application framework that uses Python and MariaDB on the server side and a tightly integrated client side library. Prior to versions 14.59.0 and 15.5.0, portal pages are susceptible to Cross-Site Scripting (XSS) which can be used to inject malicious JS code if user clicks on a malicious link. This vulnerability has been patched in versions 14.59.0 and 15.5.0. No known workarounds are available."}, {"lang": "es", "value": "Frappe es un framework de aplicaci\u00f3n web completo que utiliza Python y MariaDB en el lado del servidor y una librer\u00eda del lado del cliente estrechamente integrada. Antes de las versiones 14.59.0 y 15.5.0, las p\u00e1ginas del portal eran susceptibles a Cross-Site Scripting (XSS), que se puede utilizar para inyectar c\u00f3digo JS malicioso si el usuario hace clic en un enlace malicioso. Esta vulnerabilidad ha sido parcheada en las versiones 14.59.0 y 15.5.0. No hay workarounds disponibles."}], "id": "CVE-2024-24812", "lastModified": "2024-11-21T08:59:45.950", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 2.7, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2024-02-07T15:15:08.703", "references": [{"source": "security-advisories@github.com", "tags": ["Release Notes"], "url": "https://github.com/frappe/frappe/releases/tag/v14.59.0"}, {"source": "security-advisories@github.com", "tags": ["Release Notes"], "url": "https://github.com/frappe/frappe/releases/tag/v15.5.0"}, {"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/frappe/frappe/security/advisories/GHSA-7p3m-h76m-hg9v"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Release Notes"], "url": "https://github.com/frappe/frappe/releases/tag/v14.59.0"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Release Notes"], "url": "https://github.com/frappe/frappe/releases/tag/v15.5.0"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://github.com/frappe/frappe/security/advisories/GHSA-7p3m-h76m-hg9v"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}, {"lang": "en", "value": "CWE-80"}], "source": "security-advisories@github.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-79"}], "source": "nvd@nist.gov", "type": "Primary"}]}