CVE-2022-41712

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

Frappe version 14.10.0 allows an external attacker to remotely obtain arbitrary local files. This is possible because the application does not correctly validate the information injected by the user in the import_file parameter.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-22

Affected software

No affected versions have been published.

Timeline

Published: Nov 25, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-417135.3deep-object-diff version 1.1.0 allows an external attacker to edit or add new properties to an object. This is possible because the applicat CVE-2022-417145.3fastest-json-copy version 1.0.1 allows an external attacker to edit or add new properties to an object. This is possible because the applica CVE-2022-417157.5Programs which compile regular expressions from untrusted sources may be vulnerable to memory exhaustion or denial of service. The parsed re CVE-2022-417167.5Due to unsanitized NUL values, attackers may be able to maliciously set environment variables on Windows. In syscall.StartProcess and os/exe CVE-2022-417175.3An attacker can cause excessive memory growth in a Go server accepting HTTP/2 requests. HTTP/2 server connections contain a cache of HTTP he CVE-2022-417197.5Unmarshal can panic on some inputs, possibly allowing for denial of service attacks.CVE-2022-41726.5An integer overflow and buffer overflow issues were found in the ACPI Error Record Serialization Table (ERST) device of QEMU in the read_ers CVE-2022-417207.5On Windows, restricted files can be accessed via os.DirFS and http.Dir. The os.DirFS function and http.Dir type provide access to a tree of CVE-2022-417217.5A request smuggling attack is possible when using MaxBytesHandler. When using MaxBytesHandler, the body of an HTTP request is not fully cons CVE-2022-417227.5A path traversal vulnerability exists in filepath.Clean on Windows. On Windows, the filepath.Clean function could transform an invalid path CVE-2022-417237.5A maliciously crafted HTTP/2 stream could cause excessive CPU consumption in the HPACK decoder, sufficient to cause a denial of service from CVE-2022-417247.5Large handshake records may cause panics in crypto/tls. Both clients and servers may send large TLS handshake records which cause servers an