CVE-2023-54407: Frappe 14.x before 14.45.0 Information Disclosure via Error Log Tracebacks
Frappe 14.x before 14.45.0 contains an information disclosure vulnerability that allows users with error log access to view secrets stored in local variables captured in tracebacks. Attackers who can read error logs can extract plaintext secrets such as credentials or keys exposed in traceback local variables.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
A user who has permission to read Frappe error logs can exploit it. The issue requires authenticated, high-level privileges to access those logs.
What information may be exposed?
Tracebacks can capture local variables, which may contain plaintext secrets. Examples include credentials and keys present in local variables when an error occurs.
Which deployments need remediation?
Frappe 14.x deployments earlier than 14.45.0 are affected. Upgrading to 14.45.0 or later addresses the affected version range.
What can be done if an upgrade cannot happen immediately?
Restrict access to error logs to only trusted administrators, since reading those logs is the prerequisite for extracting exposed secrets. Review existing error logs for plaintext credentials or keys and rotate any secrets found there.