CVE-2023-54411
Frappe framework print view weak authentication exposes documents without permission (CVE-2023-54411)
Frappe framework before 13.32.0 has weak authentication for print view access. An unauthenticated attacker can derive the print view key from other whitelisted API endpoints and view documents without permission. Fixed in frappe 13.32.0.
What happened
Frappe framework before 13.32.0 uses weak authentication for print view access. The print view key can be derived from data exposed by other whitelisted API endpoints. An attacker who can reach the application can generate a valid key and use the print view to read documents without the permissions normally required.
The flaw is rated high, with a CVSS 4.0 score of 8.2. It is reachable over the network with no privileges and no user interaction, but attack complexity is high and an additional attack requirement is present. Impact is limited to confidentiality of the target. The CVE record does not indicate active exploitation or public disclosure.
Who is affected
The affected product is the Frappe framework, all versions before 13.32.0. Organisations running ERPNext or other applications built on Frappe should check the underlying framework version, because the vulnerable component is the print view access mechanism. Any document type reachable through the print view is potentially exposed until the framework is upgraded.
What to do now
- Upgrade the Frappe framework to 13.32.0. This is the fixed release listed in the CVE record.
- No workaround is listed in the CVE record. Until the upgrade is applied, restrict network access to the Frappe application and its print view endpoints to trusted users and networks only.
- Review which accounts and API clients can reach the whitelisted endpoints that expose the data used to derive the print view key, and apply least privilege to those APIs.
How to detect it
No vendor-published indicators of compromise are included in the CVE record. As a precaution, review print view access for documents that the requesting account should not be able to open, particularly where the request arrives from an unexpected source.
Beyond the patch
ERP platforms such as ERPNext carry sensitive operational and financial data, so a weakness in the underlying framework matters beyond the immediate patch. This is also a supply-chain problem: the fix arrives in a Frappe framework release, and the exposure window is set by how quickly your team applies upstream updates. Supply Chain Defense & Third-Party Risk helps track which vendors' software you run and how quickly they fix it. If you are unsure where your Frappe instances are exposed, Virtual CISO Services (vCISO) can help you map the attack surface and prioritise exposure.
Affected and fixed versions
| Product | Affected | Fixed in |
|---|---|---|
| frappe | – < 13.32.0 | 13.32.0 |