CVE-2022-23058 : Security Advisory and Response

ERPNext in versions v12.0.9-v13.0.3 is affected by a stored XSS vulnerability that allows low privileged users to store malicious scripts in the 'username' field in 'my settings' which can lead to a full account takeover.

Understanding CVE-2022-23058

This CVE-2022-23058 affects ERPNext versions v12.0.9-v13.0.3 and poses a risk of stored XSS vulnerability.

What is CVE-2022-23058?

CVE-2022-23058 is a stored XSS vulnerability in ERPNext versions v12.0.9-v13.0.3 that enables low privileged users to insert malicious scripts into the 'username' field in 'my settings', potentially resulting in a full account takeover.

The Impact of CVE-2022-23058

The impact of this vulnerability is rated as MEDIUM severity with a CVSS base score of 5.4. It requires low privileges to exploit, necessitates user interaction, and can lead to compromised confidentiality and integrity.

Technical Details of CVE-2022-23058

This section covers specific technical details of the CVE-2022-23058 vulnerability.

Vulnerability Description

The vulnerability allows attackers to execute malicious scripts by storing them in the 'username' field within 'my settings', leading to potential account compromise.

Affected Systems and Versions

ERPNext versions v12.0.9-v13.0.3 are impacted by this vulnerability.

Exploitation Mechanism

Exploiting this vulnerability requires inserting malicious scripts into the 'username' field under 'my settings' by low privileged users, facilitating a full account takeover.

Mitigation and Prevention

It's crucial to take immediate actions to mitigate the risks associated with CVE-2022-23058.

Immediate Steps to Take

Update ERPNext to version v13.1.0 or later to remediate the stored XSS vulnerability and enhance security.

Long-Term Security Practices

Enforce secure coding practices, conduct regular security audits, and educate users about best practices to prevent similar vulnerabilities.

Patching and Updates

Stay informed about security updates and patches released by ERPNext to address known vulnerabilities and enhance system security.