CVE-2023-42807

MEDIUM

6.3

Descripcion

Frappe LMS is an open source learning management system. In versions 1.0.0 and prior, on the People Page of LMS, there was an SQL Injection vulnerability. The issue has been fixed in the `main` branch. Users won't face this issue if they are using the latest main branch of the app.

Detalles CVE

Puntuacion CVSS v3.16.3

SeveridadMEDIUM

Vector CVSSCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L

Vector de ataqueNETWORK

ComplejidadLOW

Privilegios requeridosNONE

Interaccion usuarioREQUIRED

Publicado9/21/2023

Ultima modificacion10/3/2025

Fuentenvd

Avistamientos honeypot0

Productos afectados

frappe:learning

Debilidades (CWE)

CWE-89

Referencias

https://github.com/frappe/lms/security/advisories/GHSA-wvq3-3wvp-6x63(security-advisories@github.com)

https://github.com/frappe/lms/security/advisories/GHSA-wvq3-3wvp-6x63(af854a3a-2127-422b-91ae-364da2661108)

Correlaciones IOC

Sin correlaciones registradas

This product uses data from the NVD API but is not endorsed or certified by the NVD.