CVE-2023-54407

4.9Medium

Published 12 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash

4.9Medium

Attack vector: Network
Complexity: Low
Privileges needed: High
User interaction: None
Impact: High impact on confidentiality
Weakness: CWE-532

Impact

High-privilege users can read plaintext secrets like credentials and API keys exposed in system tracebacks. They need network access and an account with permission to view Frappe error logs.

Root cause

The application captures and stores unredacted local variables within error log tracebacks.

Affected systems

Frappe 14.x before 14.45.0

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Fix & remediation

Upgrade to Frappe 14.45.0 or later. If you cannot upgrade immediately, restrict user role access to the Error Log DocType.

shell

$ bench update --apps frappe

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

Frappe 14.x before 14.45.0 contains an information disclosure vulnerability that allows users with error log access to view secrets stored in local variables captured in tracebacks. Attackers who can read error logs can extract plaintext secrets such as credentials or keys exposed in traceback local variables.

References

Source: nvd.nist.gov/vuln/detail/CVE-2023-54407