Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
0.0
CVE-2024-50356: Press app lets password be reset via email, bypassing 2FA
CVE-2024-50356 · published 2 years ago
Summary
The Press custom application used on Frappe Cloud lets anyone who can access a user's email inbox reset that user's password, effectively sidestepping two‑factor authentication. This only impacts users who have turned on 2FA. Apply the latest update that includes the fix to stop the password‑reset loophole.
Original advisory text
Press has a potential 2FA bypass
Press, a Frappe custom app that runs Frappe Cloud, manages infrastructure, subscription, marketplace, and software-as-a-service (SaaS). The password could be reset by anyone who have access to the mail inbox circumventing the 2FA. Even though they wouldn't be able to login by bypassing the 2FA. Only users who have enabled 2FA are affected. Commit ba0007c28ac814260f836849bc07d29beea7deb6 patches this bug.
References
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/50xxx/CVE-2024-50356... Vendor Advisory
- https://github.com/frappe/press/security/advisories/GHSA-g7mf-rm73-r7g9 Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2024-50356 Vendor Advisory
- https://github.com/frappe/press/commit/ba0007c28ac814260f836849bc07d29beea7deb6 Patch
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Type
CWE-640Weak Password Recovery Mechanism for Forgotten Password
Timeline
Published31 Oct 2024
Updated4 Nov 2026
First seen7 Mar 2026
Track software like this
Free during beta