CVE-2024-34074 json
Frappe vuilnerable to an open redirect on login page
published 2024-05-09 2 y ago modified 2026-06-17 4 mo ago also EUVD-2024-34614
- cvss
- 6.1
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.6%
- EPSS 0.6% chance of exploitation in 30 days, percentile 47%
- public exploits
- 0
- none known
Summary
Frappe is a full-stack web application framework. Prior to 15.26.0 and 14.74.0, the login page accepts redirect argument and it allowed redirect to untrusted external URls. This behaviour can be used by malicious actors for phishing. This vulnerability is fixed in 15.26.0 and 14.74.0.
Patch / fix
- frappe frappe 14.74.0, 15.26.0
- github.com/frappe/frappe@65b3c42 commit
- github.com/frappe/frappe#26304 pull request
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 2 y ago
Exploit prediction
0.57% chance of exploitation in the next 30 days, higher than 47% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 6.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
Affected products
- frappe frappe
Classification
- Weakness
-
- CWE-601 URL Redirection to Untrusted Site
References
-
github.com
/frappe/frappe/pull/26304
issue-tracking, patch
-
github.com
/frappe/frappe/commit/65b3c42635038cdff17d3109be6c373bac004829
patch
-
github.com
/frappe/frappe/security/advisories/GHSA-7g27-q225-j894
vendor-advisory
Sources
- CVE List CVE-2024-34074
- NVD CVE-2024-34074
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.