CVE-2023-41328

Frappe is a low code web framework written in Python and Javascript. A SQL Injection vulnerability has been identified in the Frappe Framework which could allow a malicious actor to access sensitive information. This issue has been addressed in versions 13.46.1 and 14.20.0. Users are advised to upgrade. There's no workaround to fix this without upgrading.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/frappe/frappe/releases/tag/v13.46.1	Third Party Advisory
https://github.com/frappe/frappe/releases/tag/v14.20.0	Third Party Advisory
https://github.com/frappe/frappe/security/advisories/GHSA-53wh-f67g-9679	Third Party Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:frappe:frappe::::::::
	cpe:2.3:a:frappe:frappe::::::::

History

11 Sep 2023, 18:05

Type	Values Removed	Values Added
First Time		Frappe Frappe frappe
CPE		cpe:2.3:a:frappe:frappe::::::::
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 7.5
References	~~(MISC) https://github.com/frappe/frappe/releases/tag/v13.46.1 -~~	(MISC) https://github.com/frappe/frappe/releases/tag/v13.46.1 - Third Party Advisory
References	~~(MISC) https://github.com/frappe/frappe/releases/tag/v14.20.0 -~~	(MISC) https://github.com/frappe/frappe/releases/tag/v14.20.0 - Third Party Advisory
References	~~(MISC) https://github.com/frappe/frappe/security/advisories/GHSA-53wh-f67g-9679 -~~	(MISC) https://github.com/frappe/frappe/security/advisories/GHSA-53wh-f67g-9679 - Third Party Advisory

06 Sep 2023, 18:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2023-09-06 18:15

Updated : 2024-02-28 20:33

NVD link : CVE-2023-41328

Mitre link : CVE-2023-41328

CVE.ORG link : CVE-2023-41328

JSON object : View

Products Affected

frappe

frappe

CWE

CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

{"id": "CVE-2023-41328", "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 3.9}, {"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.2, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 2.5, "exploitabilityScore": 1.6}]}, "published": "2023-09-06T18:15:09.047", "references": [{"url": "https://github.com/frappe/frappe/releases/tag/v13.46.1", "tags": ["Third Party Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/frappe/frappe/releases/tag/v14.20.0", "tags": ["Third Party Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/frappe/frappe/security/advisories/GHSA-53wh-f67g-9679", "tags": ["Third Party Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-89"}]}], "descriptions": [{"lang": "en", "value": "Frappe is a low code web framework written in Python and Javascript. A SQL Injection vulnerability has been identified in the Frappe Framework which could allow a malicious actor to access sensitive information. This issue has been addressed in versions 13.46.1 and 14.20.0. Users are advised to upgrade. There's no workaround to fix this without upgrading."}, {"lang": "es", "value": "Frappe es un framework web de c\u00f3digo bajo escrito en Python y Javascript. Se ha identificado una vulnerabilidad de inyecci\u00f3n SQL en Frappe Framework que podr\u00eda permitir a un actor malintencionado acceder a informaci\u00f3n confidencial. Este problema se ha solucionado en las versiones 13.46.1 y 14.20.0. Se recomienda a los usuarios que actualicen. No hay ning\u00fan workaround para solucionar esto sin actualizar."}], "lastModified": "2023-09-11T18:05:46.093", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:frappe:frappe:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "418BFA9F-DE58-440C-BC07-A7195C346BE5", "versionEndExcluding": "13.46.1"}, {"criteria": "cpe:2.3:a:frappe:frappe:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "257F1200-5913-42A0-B2FF-C9B7A5FDC7DD", "versionEndExcluding": "14.20.0", "versionStartIncluding": "14.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}