Frappe vulnerable to information disclosure leading to account takeover

高 7.5CVE-2025-30214 · GHSA-qrv3-jc3h-f3m6 · PYSEC-2026-1392 · 25/03/2025 公開 · 17/06/2026 更新

要点

CVE-2025-30214 は frappe, frappe (frappe) に影響する深刻度「高」 (CVSS 7.5) の脆弱性です。
今後30日間に悪用される確率（EPSS）：0.41%（全脆弱性の 35.8% より高い）。
対処：15.51.0, 14.89.0 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
frappe PyPI	`≥ 15.0.0, < 15.51.0< 14.89.0`	`15.51.014.89.0`
frappe frappe	`≥ 15.0.0, < 15.51.0< 14.89.0`	`15.51.014.89.0`

概要

Impact

Making crafted requests could lead to information disclosure that could further lead to account takeover.

Workarounds

There's no workaround to fix this without upgrading.

Credits

Thanks to Thanh of Calif.io for reporting the issue

NVD の説明

Frappe is a full-stack web application framework. Prior to versions 14.89.0 and 15.51.0, making crafted requests could lead to information disclosure that could further lead to account takeover. Versions 14.89.0 and 15.51.0 fix the issue. There's no workaround to fix this without upgrading.