Description (CNA)
Frappe Framework before 15.120.0 and 16.x before 16.33.0 contains a missing authorization vulnerability in the whitelisted send_sms API endpoint, which does not verify that the caller is permitted to send SMS messages. Users lacking the required permissions can invoke send_sms to send arbitrary SMS messages that impersonate the Company.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| frappe / frappe | affected 0 before 15.120.0; affected 16.0.0-beta.1 before 16.33.0; unaffected 15.120.0; unaffected 16.33.0 |
CWE
CWE-862
References
- https://github.com/frappe/frappe/security/advisories/GHSA-wrh5-p77r-jpvq
- https://www.vulncheck.com/advisories/frappe-before-16.33.0-broken-authorization-via-send-sms-endpoint
ADP enrichment
No English description supplied.
No references supplied.