Skip to content
CVE PROGRAM SOURCE RECORD4.2 Medium

CVE-2023-41328

Possibility limited SQL injection due to insufficient validation in Frappe

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
GitHub_M

Description

Frappe is a low code web framework written in Python and Javascript. A SQL Injection vulnerability has been identified in the Frappe Framework which could allow a malicious actor to access sensitive information. This issue has been addressed in versions 13.46.1 and 14.20.0. Users are advised to upgrade. There's no workaround to fix this without upgrading.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

frappe frappe

  • < 13.46.1 affected
  • >= 14.0.0, < 14.20.0affected

References