CVE-2019-20521

Name of the Vulnerable Software and Affected Versions ERPNext version 11.1.47

Description The issue allows for reflected XSS via the PATH INFO to the "api/" URI. This means an attacker can craft a malicious URL that, when visited by a user, can execute arbitrary JavaScript code in the context of the ERPNext application.

Recommendations For ERPNext version 11.1.47, update to a newer version that contains a fix for this issue. As a temporary workaround, consider restricting access to the "api/" URI to minimize the risk of exploitation.