CVE-2023-54407

medium

Description

Frappe 14.x before 14.45.0 contains an information disclosure vulnerability that allows users with error log access to view secrets stored in local variables captured in tracebacks. Attackers who can read error logs can extract plaintext secrets such as credentials or keys exposed in traceback local variables.

References

https://www.vulncheck.com/advisories/frappe-14-x-before-14.45.0-information-disclosure-via-error-log-tracebacks

https://github.com/frappe/frappe/security/advisories/GHSA-38fg-mjcm-3hc6

https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-60713

Details

Source: Mitre, NVD

Published: 2026-10-12

Updated: 2026-10-14

Risk Information

CVSS v2

Base Score: 6.1

Vector: CVSS2#AV:N/AC:L/Au:M/C:C/I:N/A:N

Severity: Medium

CVSS v3

Base Score: 4.9

Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Severity: Medium

CVSS v4

Base Score: 6.9

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Severity: Medium

EPSS

EPSS: 0.00306