Skip to content

SQL Injection from reporting logic

Critical
ankush published GHSA-fxfv-7gwx-54jh Mar 20, 2024

Package

frappe (Frappe)

Affected versions

<=14.63.0

Patched versions

14.64.0

Description

Impact

What kind of vulnerability is it? Who is impacted?
SQL injection from a particular whitelisted method can result in access to data which user doesn't have permission to.

Workarounds

Is there a way for users to fix or remediate the vulnerability without upgrading?
There are no workarounds, it's advisable to immediately upgrade your site to latest version.

Severity

Critical

CVE ID

CVE-2024-24813

Weaknesses

No CWEs

Credits