Vulnerability Database

299,584

Total vulnerabilities in the database

CVE-2022-23056

In ERPNext, versions v13.0.0-beta.13 through v13.30.0 are vulnerable to Stored XSS at the Patient History page which allows a low privilege user to conduct an account takeover attack.

Published: Jun 22, 2022
Updated: May 9, 2024
CVE: CVE-2022-23056
Severity: Low
Exploit:

CVSS v2:

Severity: Low
Score: 3.5
AV:N/AC:M/Au:S/C:N/I:P/A:N

CWEs:

CWE-79

OWASP TOP 10:

A7 - Cross-Site Scripting (XSS)

Affected Software
References

Software	From	Fixed in
frappe / erpnext	13.0.1	13.30.0
frappe / erpnext	13.0.0-beta14	13.0.0-beta14.x
frappe / erpnext	13.0.0-beta13	13.0.0-beta13.x

https://github.com/frappe/erpnext/blob/21a3ea462aaf319e466c067c2ec406eb9abe6ed3/erpnext/healthcare/page/patient_history/patient_history.js#L288
https://www.mend.io/vulnerability-database/CVE-2022-23056

Deep Security Visibility Without the Complexity

SynScan provides clear, real-time security insights so you can monitor your attack surface, spot risks early, and act fast—without extra complexity.

No setup fees
5-min deployment
Cancel anytime

Book a Demo