CVE-2024-49751 Frappe Press possible HTML injection through SaaS Signup inputs
Attackers can inject HTML into SaaS signup inputs, affecting only their own account, requiring a patch to Frappe Press.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2024-49751?
CVE-2024-49751 is a low-severity cross-site scripting vulnerability in frappe press, published on 23 Oct 2024. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Press, a Frappe custom app that runs Frappe Cloud, manages infrastructure, subscription, marketplace, and software-as-a-service (SaaS). Prior to commit 5d118a902872d7941f099ad1fb918e2421e79ccd, a user could inject HTML through SaaS signup inputs. The user who injected the unsafe HTML code would only affect themselves and would not affect other users. Commit 5d118a902872d7941f099ad1fb918e2421e79ccd patches this bug.
Weakness: CWE-79
Which versions are affected by CVE-2024-49751?
How do I fix CVE-2024-49751?
No fix has been published for CVE-2024-49751 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2024-49751 being exploited?
There is no known exploitation of CVE-2024-49751 in the wild and no public exploit code.
Sources
Also known as GHSA-rf69-h96f-rf2j.