Frappe is a full-stack web application framework. Prior to 14.100.1, 15.100.0, and 16.6.0, a malicious user could send a crafted request to an endpoint which would lead to the server making an HTTP call to a service of the users choice. This vulnerability is fixed in 14.100.1, 15.100.0, and 16.6.0.
Weakness
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Frappe | Frappe | * | 14.100.1 (excluding) |
| Frappe | Frappe | 15.0.0 (including) | 15.100.0 (excluding) |
| Frappe | Frappe | 16.0.0 (including) | 16.6.0 (excluding) |