CVE-2024-58390: Frappe before 15.41.0 Privilege Escalation via Document Action
Frappe before 14.81.4 and 15.x before 15.41.0 contains an improper privilege management vulnerability involving a certain document action that permits escalation from the Website User role to System Manager. Authenticated attackers with Website User access can combine this document action with additional steps to obtain administrative System Manager privileges in the Frappe application.
Affected Software
Event History
Frequently Asked Questions
Which deployments are affected?
Frappe versions before 14.81.4 are affected, as are 15.x versions before 15.41.0. The issue concerns privilege handling within the Frappe application.
What access does an attacker need to exploit this issue?
An attacker must already be authenticated with the Website User role. No user interaction is required, and the attacker can use the vulnerable document action with additional steps to seek System Manager privileges.
Are unauthenticated attackers able to exploit this vulnerability?
The provided information identifies Website User authentication as a prerequisite. It does not indicate that unauthenticated exploitation is possible.
What privilege can an attacker obtain?
A successful attacker can escalate from Website User to System Manager, which is an administrative privilege level in Frappe. The listed impact includes high confidentiality, integrity, and availability impact.