CVE-2023-54411
Last modified
CVE-2023-54411 is a medium-severity vulnerability rated 5.9/10 on the CVSS scale. Frappe framework before 13.32.0 uses weak authentication for print view access, because the print view key can be derived from data exposed by other whitelisted API endpoints. Attackers can generate a valid key to view documents through the print view without proper permissions.. EPSS estimates a 0.26% chance of exploitation in the next 30 days.
Description
Frappe framework before 13.32.0 uses weak authentication for print view access, because the print view key can be derived from data exposed by other whitelisted API endpoints. Attackers can generate a valid key to view documents through the print view without proper permissions.
Metrics
Weakness Enumeration
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2023-54411?
How severe is CVE-2023-54411?
How do I fix CVE-2023-54411?
How Strix Helps
- Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2023
- CVE-2023-54406Frappe before 14.59.0 and 15.x before 15.5.0 contains a sand…4.9
- CVE-2023-54407Frappe 14.x before 14.45.0 contains an information disclosur…4.9
- CVE-2023-54408Frappe before 13.52.0 and 14.x before 14.31.0 contains an HT…6.1
- CVE-2023-54409Frappe before 13.46.1 and 14.x before 14.20.0 contains a cro…4.8
- CVE-2023-5441NULL Pointer Dereference in GitHub repository vim/vim prior …5.5
- CVE-2023-54410Frappe before 13.22.0 contains an improper authorization vul…4.3
- CVE-2023-54412Frappe before 13.46.3 and 14.x before 14.21.1 contains an im…6.5
- CVE-2023-54413WPML Multilingual CMS plugin for WordPress before 4.6.1 cont…6.1
- CVE-2023-5442Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMB…
- CVE-2023-5443Improper Protection for Outbound Error Messages and Alert Si…7.5
- CVE-2023-5444 A Cross Site Request Forgery vulnerability in ePolicy Orche…8
- CVE-2023-5445 An open redirect vulnerability in ePolicy Orchestrator prio…5.4
Are you affected by CVE-2023-54411?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST