CVE-2023-54406
Last modified
CVE-2023-54406 is a medium-severity vulnerability rated 4.9/10 on the CVSS scale. Frappe before 14.59.0 and 15.x before 15.5.0 contains a sandbox flaw where the frappe.flags.in_safe_exec global flag can become False during Server Script execution when one server script triggers another. Authenticated high-privileged users can craft a Server Script that triggers other server scripts, such as by saving a document, so the remaining code runs without safe execution protections.. EPSS estimates a 0.32% chance of exploitation in the next 30 days.
Description
Frappe before 14.59.0 and 15.x before 15.5.0 contains a sandbox flaw where the frappe.flags.in_safe_exec global flag can become False during Server Script execution when one server script triggers another. Authenticated high-privileged users can craft a Server Script that triggers other server scripts, such as by saving a document, so the remaining code runs without safe execution protections.
Metrics
Weakness Enumeration
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2023-54406?
How severe is CVE-2023-54406?
How do I fix CVE-2023-54406?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2023
- CVE-2023-54399Hongjing e-HR before 8.2 contains a SQL injection vulnerabil…9.8
- CVE-2023-54400Fumasoft Fumeng Cloud contains a SQL injection vulnerability…9.8
- CVE-2023-54402iDocView contains a server-side request forgery vulnerabilit…7.5
- CVE-2023-54403Yonyou U8 CRM before V16.5 and V18 contains an arbitrary fil…7.5
- CVE-2023-54404Rejected reason: This CVE ID has been rejected or withdrawn …
- CVE-2023-54405H3C CVM, the Cloud Virtualization Management component of th…9.8
- CVE-2023-54407Frappe 14.x before 14.45.0 contains an information disclosur…4.9
- CVE-2023-54408Frappe before 13.52.0 and 14.x before 14.31.0 contains an HT…6.1
- CVE-2023-54409Frappe before 13.46.1 and 14.x before 14.20.0 contains a cro…4.8
- CVE-2023-5441NULL Pointer Dereference in GitHub repository vim/vim prior …5.5
- CVE-2023-54410Frappe before 13.22.0 contains an improper authorization vul…4.3
- CVE-2023-54411Frappe framework before 13.32.0 uses weak authentication for…5.9
Are you affected by CVE-2023-54406?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST