CVE-2024-58391

Deferred Deferred - Pending Action

Cross-Site Scripting in Frappe Printview

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: VulnCheck

Description

Frappe before 14.58.0 and 15.x before 15.4.0 contains a cross-site scripting vulnerability in printview because printview parameters are not escaped before being rendered. Remote attackers can craft a malicious printview URL that, when visited by a victim, injects HTML and executes script in the victim's browser session.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-12

Last Modified

2026-10-12

Generated

2026-10-13

AI Q&A

2026-10-13

EPSS Evaluated

N/A

NVD

CVE-2024-58391

Affected Vendors & Products

Vendor	Product	Version / Range
frappe	frappe	0
frappe	frappe	15.0.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

Frappe versions before 14.58.0 and 15.x before 15.4.0 have a cross-site scripting (XSS) vulnerability in the printview feature. The issue occurs because printview parameters are not properly escaped before being rendered in the browser. This allows remote attackers to craft malicious URLs that inject HTML and execute scripts when visited by a victim.

Detection Guidance

This vulnerability can be detected by checking the version of Frappe installed on your system. If you are running Frappe version 14.58.0 or earlier, or version 15.x before 15.4.0, your system is vulnerable. You can check the version by running commands like 'bench version' or by inspecting the package.json file in your Frappe installation directory.

Impact Analysis

This vulnerability could allow attackers to steal session cookies, perform actions on your behalf, or redirect you to malicious websites. If you use a vulnerable Frappe version, visiting a crafted printview URL could lead to unauthorized access to your account or data.

Compliance Impact

This XSS vulnerability could lead to unauthorized data access or modification, violating GDPR's data protection principles or HIPAA's security requirements. Organizations may face compliance violations if user data is compromised due to this issue.

Mitigation Strategies

To mitigate this vulnerability, immediately upgrade Frappe to version 14.58.0 or later for version 14.x, or to version 15.4.0 or later for version 15.x. Follow the official Frappe upgrade documentation to ensure a smooth and secure update process.

Hi! I’m here to help you understand CVE-2024-58391. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70