Vulnerability · Published Sep 6, 2023 · Assigned by GitHub_M
CVE-2023-41328Possibility limited SQL injection due to insufficient validation in Frappe
Medium 4.2
In plain English
A medium-severity SQL injection in frappe from frappe. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 42% of all known vulnerabilities).
Severity (CVSS 3.1)4.2Medium
Exploit odds (30 days)0.5%top 57.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Frappe is a low code web framework written in Python and Javascript. A SQL Injection vulnerability has been identified in the Frappe Framework which could allow a malicious actor to access sensitive information. This issue has been addressed in versions 13.46.1 and 14.20.0. Users are advised to upgrade. There's no workaround to fix this without upgrading.
Affected products (as reported)
Weakness: CWE-89 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N
References
- https://github.com/frappe/frappe/security/advisories/GHSA-53wh-f67g-9679 x_refsource_CONFIRM
- https://github.com/frappe/frappe/releases/tag/v13.46.1 x_refsource_MISC
- https://github.com/frappe/frappe/releases/tag/v14.20.0 x_refsource_MISC