Description (CNA)
Frappe is a full-stack web application framework. In version 16.31.0 and earlier, the whitelisted frappe.model.workflow.bulk_workflow_approval endpoint in frappe/model/workflow.py accepts safe HTTP methods for state-changing workflow approvals because the endpoint is not restricted to POST. An attacker can induce an authenticated victim browser to submit an approval action with the victim privileges. No released fixed version is available as of this review.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| frappe / frappe | affected <= 16.31.0 |
CWE
CWE-352
References
- https://github.com/frappe/frappe/security/advisories/GHSA-cgwf-xgph-hxgm
- https://github.com/frappe/frappe/pull/41361
- https://github.com/frappe/frappe/commit/8465376ad9f81775c20892338f920c695b88fb1f
ADP enrichment
No English description supplied.
No references supplied.