Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.8
CVE-2023-54407: Frapi 14.x may reveal passwords in error logs
CVE-2023-54407 · published 23 days ago
Summary
If someone can read the system’s error logs on Frapi version 14.x before 14.45.0, they could see sensitive data like passwords or keys that appear in the detailed error messages. Limit access to error logs and upgrade to the latest version to stop this from happening.
What to do
- Update frappe frappe to version 14.45.0 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| frappe | frappe | < 14.45.0 |
Original advisory text
Frappe 14.x before 14.45.0 Information Disclosure via Error Log Tracebacks
Frappe 14.x before 14.45.0 contains an information disclosure vulnerability that allows users with error log access to view secrets stored in local variables captured in tracebacks. Attackers who can read error logs can extract plaintext secrets such as credentials or keys exposed in traceback local variables.
References
- https://github.com/frappe/frappe/security/advisories/GHSA-38fg-mjcm-3hc6 Vendor Advisory
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/54xxx/CVE-2023-54407... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2023-54407 Vendor Advisory
- https://www.vulncheck.com/advisories/frappe-14-x-before-14.45.0-information-disc... Vendor Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Severity
7.8
High
Type
CWE-532Insertion of Sensitive Information into Log File
Timeline
Published12 Oct 2026
Updated31 Oct 2026
First seen12 Oct 2026
Track software like this
Free during beta