PT-2023-27906 · Frappe · Frappe

Sagarvora · Published 2023-09-06 · Updated 2023-09-11 · CVE-2023-41328

Positive Technologies (AI Summary)

CVSS v3.1

4.2

Medium

Base vector

AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Frappe versions prior to 13.46.1 Frappe versions prior to 14.20.0

Description A SQL Injection issue has been identified in the Frappe Framework, which could allow a malicious actor to access sensitive information.

Recommendations For versions prior to 13.46.1, upgrade to version 13.46.1 or later. For versions prior to 14.20.0, upgrade to version 14.20.0 or later.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2023-41328

GHSA-53WH-F67G-9679

Affected Products

Frappe

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/41xxx/CVE-2023-41328.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-41328 · Security Note
• https://osv.dev/vulnerability/CVE-2023-41328 · Vendor Advisory
• https://github.com/frappe/frappe/releases/tag/v13.46.1 · Note
• https://github.com/frappe/frappe/security/advisories/GHSA-53wh-f67g-9679 · Note
• https://github.com/frappe/frappe/releases/tag/v14.20.0 · Note
• https://twitter.com/CVEnew/status/1699480845025718764 · Twitter Post
• https://t.me/cibsecurity/70025 · Telegram Post