Frappe is a full-stack web application framework. Prior to 16.23.0, the get_count() method in reportview composes a count operation around generated SQL through a raw database execution path, allowing crafted report input to alter SQL executed by the application. This issue is fixed in version 16.23.0.
Attack Parameters
Attack Vector
Network
Can be exploited remotely
Attack Complexity
Low
Easy to exploit
Attack Requirements
None
No additional conditions
Privileges Required
Low
Basic privileges needed
User Interaction
None
No user interaction needed
Impact Assessment
Confidentiality
High
Complete data leak
Integrity
High
Complete data modification
Availability
Low
Partial disruption
CVSS Vector v4.0
Weakness Type (CWE)
References 6
https://github.com/frappe/frappe/commit/49dbde7460fa41528154088d23b6c6e12f733f9b
security-advisories@github.com
https://github.com/frappe/frappe/commit/f4f2df926e3c2db2da5fc79983f285397c028690
security-advisories@github.com
https://github.com/frappe/frappe/pull/40022
security-advisories@github.com
https://github.com/frappe/frappe/pull/40027
security-advisories@github.com
https://github.com/frappe/frappe/releases/tag/v16.23.0
security-advisories@github.com
https://github.com/frappe/frappe/security/advisories/GHSA-mf6r-q34j-pjw7
security-advisories@github.com