Frappe is a full-stack web application framework. Prior to 15.26.0 and 14.74.0, the login page accepts redirect argument and it allowed redirect to untrusted external URls. This behaviour can be used by malicious actors for phishing. This vulnerability is fixed in 15.26.0 and 14.74.0.
CVSS
No CVSS.
References
| Link | Resource |
|---|---|
| https://github.com/frappe/frappe/commit/65b3c42635038cdff17d3109be6c373bac004829 | Patch |
| https://github.com/frappe/frappe/commit/65b3c42635038cdff17d3109be6c373bac004829 | Patch |
| https://github.com/frappe/frappe/pull/26304 | Issue Tracking Patch |
| https://github.com/frappe/frappe/pull/26304 | Issue Tracking Patch |
| https://github.com/frappe/frappe/security/advisories/GHSA-7g27-q225-j894 | Vendor Advisory |
| https://github.com/frappe/frappe/security/advisories/GHSA-7g27-q225-j894 | Vendor Advisory |
Configurations
Configuration 1 (hide)
|
History
04 Aug 2025, 14:37
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Frappe frappe
Frappe |
|
| CPE | cpe:2.3:a:frappe:frappe:*:*:*:*:*:*:*:* | |
| References | () https://github.com/frappe/frappe/pull/26304 - Issue Tracking, Patch | |
| References | () https://github.com/frappe/frappe/security/advisories/GHSA-7g27-q225-j894 - Vendor Advisory | |
| References | () https://github.com/frappe/frappe/commit/65b3c42635038cdff17d3109be6c373bac004829 - Patch |
14 May 2024, 16:12
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2024-05-14 15:38
Updated : 2025-08-04 14:37
NVD link : CVE-2024-34074
Mitre link : CVE-2024-34074
JSON object : View
Products Affected
frappe
- frappe
CWE
No CWE.