CyberRota Analysis
AI-GeneratedThe Frappe Framework development builds have an authorization vulnerability in the render_jinja_template endpoint, enabling low-privileged users to render arbitrary Jinja templates by providing raw template strings. This flaw allows attackers with print permissions to execute arbitrary SELECT statements on unrelated tables, potentially exposing sensitive data such as password hashes from the __Auth table. Organizations using Frappe Framework should prioritize addressing this vulnerability to mitigate the risk of unauthorized data access.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Frappe Framework development builds contain an authorization flaw in the render_jinja_template endpoint that allows low-privileged users to render arbitrary Jinja templates by supplying raw template strings. Attackers with print permission on any document can execute arbitrary SELECT statements against unrelated tables, including reading password hashes from the __Auth table.