CVE-2022-23056: ERPNext - Stored XSS leads to account takover

Severity: low (CVSS 3.5 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.9% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2022-06-22 · updated 2026-06-17
Weakness: CWE-79

Description

In ERPNext, versions v13.0.0-beta.13 through v13.30.0 are vulnerable to Stored XSS at the Patient History page which allows a low privilege user to conduct an account takeover attack.

Affected products

frappe erpnext: from 13.0.1 before 13.30.0; 13.0.0-beta13, 13.0.0-beta14 — fixed in 13.30.0

How to fix

Upgrade to a fixed version: frappe erpnext 13.30.0. Check the vendor advisory for mitigations.

References

https://github.com/frappe/erpnext/blob/21a3ea462aaf319e466c067c2ec406eb9abe6ed3/erpnext/healthcare/page/patient_history/patient_history.js#L288
https://www.mend.io/vulnerability-database/CVE-2022-23056
https://github.com/frappe/erpnext/blob/21a3ea462aaf319e466c067c2ec406eb9abe6ed3/erpnext/healthcare/page/patient_history/patient_history.js#L288
https://www.mend.io/vulnerability-database/CVE-2022-23056

Get alerted when CVE-2022-23056 or the next vulnerability affects your stack