Vulnerability Report

CVE-2024-34074

Title: Frappe

Other

Proof Of Concept

No public PoC currently indexed for CVE-2024-34074.

CWE Category CWE-601

Published Date May 14, 2024

Modified Date Aug 04, 2025

Exploit Status Not Found

Score 6.1 CVSS v3.1

Exploit Probability (EPSS)

0.57%

Vulnerability Summary

CVE-2024-34074: Frappe is a full-stack web application framework. Prior to 15.26.0 and 14.74.0, the login page accepts redirect argument and it allowed redirect to untrusted external URls. This behaviour can be used by malicious actors for phishing. This vulnerability is fixed in 15.26.0 and 14.74.0.

Impacted Vendors

frappe 1

Reference Links

https://github.com/frappe/frappe/commit/65b3c42635038cdff17d3109be6c373bac004829 https://github.com/frappe/frappe/pull/26304 https://github.com/frappe/frappe/security/advisories/GHSA-7g27-q225-j894 https://github.com/frappe/frappe/commit/65b3c42635038cdff17d3109be6c373bac004829 https://github.com/frappe/frappe/pull/26304 https://github.com/frappe/frappe/security/advisories/GHSA-7g27-q225-j894

CVSS v3.1

Source Entity [email protected]

Severity MEDIUM

6.1

Attack Vector

NETWORK

Complexity

LOW

Privileges

N/A

Interaction

REQUIRED

Confidentiality

N/A

Integrity

N/A

Availability

N/A

Scope

CHANGED

RAW VECTOR CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Associated Attack Patterns (CAPEC)

Total: Patterns

CVE-2024-34074 Exploits & PoCs (Proof Of Concept)

No public PoCs found in our database for this CVE.

August 04, 2025 MODIFIED

Vulnerability data or affected products updated.

May 14, 2024 PUBLISHED

Vulnerability first announced in NVD.

Attack Vector Matrix

Access Vector NETWORK

Complexity LOW

Privileges N/A

Interaction REQUIRED

CVSS Vector String


                                    CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Affected Stack

No specific products linked.