GitHub Advisoryadvisory · PyPI

GHSA-qrv3-jc3h-f3m6 Frappe vulnerable to information disclosure leading to account takeover

HIGH Published 2025-03-25 Modified 2025-03-25 Official page ↗
Aliases
CVE-2025-30214
Ecosystem
PyPI
Packages
frappe
Severity
High
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U
Weaknesses
CWE-200
Reviewed
2025-03-25

Affected packages

• PyPI frappe: < 14.89.0 → fixed in 14.89.0 • PyPI frappe: >= 15.0.0, < 15.51.0 → fixed in 15.51.0

Description

Impact Making crafted requests could lead to information disclosure that could further lead to account takeover. Workarounds There's no workaround to fix this without upgrading. Credits Thanks to Thanh of Calif.io for reporting the issue

Related

Alias · CVE (1)

  • CVE-2025-30214 Frappe is a full-stack web application framework. vulnerability

Weakness · CWE (1)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness

References