CVE-2023-41328CWE-89

Possibility limited SQL injection due to insufficient validation in Frappe

Medium · published September 6, 2023

CVSS v3.1
4.2
EPSS
0%
Percentile
41.1
In the wild
Unconfirmed
What it is

Frappe is a low code web framework written in Python and Javascript. A SQL Injection vulnerability has been identified in the Frappe Framework which could allow a malicious actor to access sensitive information. This issue has been addressed in versions 13.46.1 and 14.20.0. Users are advised to upgrade. There's no workaround to fix this without upgrading.

The record
Technical detail
CVSS v3.1
4.2 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00488 · 41.1th percentile
Weakness
CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published
2023-09-06T17:46Z
EPSS history
Timeline
  • 06 SEP 17:46Z
    Possibility limited SQL injection due to insufficient validation in Frappe
    cvelistv5