PT-2020-10487
CVE-2019-20511
·
تاريخ النشر
2020-03-18
·
تاريخ التحديث
2020-08-24
الوصف من
CVSS 3.1
6.1
متوسطةالمقاييسAV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Name of the Vulnerable Software and Affected Versions
ERPNext version 11.1.47
Description
The issue allows for frame injection via the blog category parameter. This can be exploited through the "blog?blog category=" endpoint. The
blog category parameter is vulnerable to injection.Recommendations
For ERPNext version 11.1.47, consider restricting access to the blog category parameter to minimize the risk of exploitation. As a temporary workaround, avoid using the
blog category parameter in the affected endpoint until the issue is resolved. وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾