Description
Frappe is a full-stack web application framework. Prior to 14.100.1, 15.100.0, and 16.6.0, a malicious user could send a crafted request to an endpoint which would lead to the server making an HTTP call to a service of the user's choice. This vulnerability is fixed in 14.100.1, 15.100.0, and 16.6.0.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| frappe | frappe | >= 16.0.0, < 16.6.0, >= 15.0.0, < 15.100.0, < 14.100.1 | — |