SQL Injection in Frappe
CVE-2023-41328
Frappe is a low code web framework written in Python and Javascript. A SQL Injection vulnerability has been identified in the Frappe Framework which could allow a malicious actor to access sensitive information. This issue has been addressed in versions 13.46.1 and 14.20.0. Users are advised to upgrade. There's no workaround to fix this without upgrading.
Vulnerability class: SQL Injection
EPSS: 0.004 (34.6th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 4.2 (Medium). Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N.
Affected products
- Frappe — versions < 13.46.1 , >= 14.0.0, < 14.20.0
Weakness classification (CWE)
References
- security-advisories@github.com (x_refsource_CONFIRM, Third Party Advisory)
- security-advisories@github.com (Third Party Advisory, x_refsource_MISC)
- security-advisories@github.com (Third Party Advisory, x_refsource_MISC)
Frequently asked questions
- What is CVE-2023-41328?
- CVE-2023-41328 is a medium-severity vulnerability in Frappe, classified under SQL Injection. CVSS score: 4.2/10. Published 2023-09-06.
- How severe is CVE-2023-41328?
- Medium severity. CVSS v3 base score is 4.2 out of 10.