CVE-2023-54407
Frappe 14.x before 14.45.0 Information Disclosure via Error Log Tracebacks
- State
- Published
- Severity
- 6.9 Medium
- Published
- Oct 12, 2026
- Updated
- Oct 14, 2026
- Reserved
- Oct 12, 2026
Description
Frappe 14.x before 14.45.0 contains an information disclosure vulnerability that allows users with error log access to view secrets stored in local variables captured in tracebacks. Attackers who can read error logs can extract plaintext secrets such as credentials or keys exposed in traceback local variables.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 6.9 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 4.9 Medium | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N | VulnCheck |
Weaknesses
- CWE-532 Insertion of Sensitive Information into Log File
Affected Products
| Product | Versions |
|---|---|
frappefrappe |
|
References
- GitHub Security Advisory (GHSA-38fg-mjcm-3hc6)vendor-advisory
- VulnCheck Advisory: Frappe 14.x before 14.45.0 Information Disclosure via Error Log Tracebacksthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.