Vulnerability in Frappe Press
CVE-2024-50356
Press, a Frappe custom app that runs Frappe Cloud, manages infrastructure, subscription, marketplace, and software-as-a-service (SaaS). The password could be reset by anyone who have access to the mail inbox circumventing the 2FA. Even tho…
EPSS: 0.000 (10.4th percentile) — read the EPSS interpretation.
Affected products
- Frappe Press — versions < ba0007c28ac814260f836849bc07d29beea7deb6
Weakness classification (CWE)
Public proof-of-concept exploits
References
- https://github.com/frappe/press/security/advisories/GHSA-g7mf-rm73-r7g9 (x_refsource_CONFIRM)
- https://github.com/frappe/press/commit/ba0007c28ac814260f836849bc07d29beea7deb6 (x_refsource_MISC)
Frequently asked questions
- What is CVE-2024-50356?
- CVE-2024-50356 is a vulnerability in Frappe Press, classified under Weak Password Recovery Mechanism for Forgotten Password. Published 2024-10-31.
- Is CVE-2024-50356 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.