CVE-2024-34074CWE-601

Frappe vuilnerable to an open redirect on login page

Medium · published May 9, 2024

CVSS v3.1
6.1
EPSS
1%
Percentile
46.6
In the wild
Unconfirmed
What it is

Frappe is a full-stack web application framework. Prior to 15.26.0 and 14.74.0, the login page accepts redirect argument and it allowed redirect to untrusted external URls. This behaviour can be used by malicious actors for phishing. This vulnerability is fixed in 15.26.0 and 14.74.0.

The record
Technical detail
CVSS v3.1
6.1 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00574 · 46.6th percentile
Weakness
CWE-601 · URL Redirection to Untrusted Site ('Open Redirect')
Published
2024-05-09T14:25Z
EPSS history
Timeline
  • 09 MAY 14:25Z
    Frappe vuilnerable to an open redirect on login page
    cvelistv5