CVEvulnerability

CVE-2023-41328

7.5 HIGH Published 2023-09-06 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2023-09-06
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
4.2 MEDIUM — CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N
CVSS 3.1 ([email protected])
7.5 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-89

Description

Frappe is a low code web framework written in Python and Javascript. A SQL Injection vulnerability has been identified in the Frappe Framework which could allow a malicious actor to access sensitive information. This issue has been addressed in versions 13.46.1 and 14.20.0. Users are advised to upgrade. There's no workaround to fix this without upgrading.

Affected configurations

• frappe frappe (< 13.46.1) • frappe frappe (>= 14.0.0 < 14.20.0)

Related

Weakness · CWE (1)

  • CWE-89 Improper Neutralization of Special Elements used in an SQL Command weakness

References