UpHeron
All vulnerabilities

Servers and applications

CVE-2024-34074

Open redirect on login page

Severity
Medium 6.1
Published
9 May 2024
Last changed
17 Jun 2026
Added to UpHeron
3 Nov 2026
Fixed in
14.74.0, 15.26.0
Also known as
GHSA-7g27-q225-j894
Sources
NVD, Project advisories (GitHub)

Description

Frappe is a full-stack web application framework. Prior to 15.26.0 and 14.74.0, the login page accepts redirect argument and it allowed redirect to untrusted external URls. This behaviour can be used by malicious actors for phishing. This vulnerability is fixed in 15.26.0 and 14.74.0.

Affected software

SoftwareAffected versions
Frappe FrameworkServers and applications · cpe:a:frappe:frappe
  • Every version before 14.74.0
  • From 15.0.0 before 15.26.0
Frappe FrameworkServers and applications · github:frappe/frappe
  • Every version before 15.26.0
  • Every version before 14.74.0

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2024-34074
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2024-34074
  • GitHub Advisory Database https://github.com/advisories/GHSA-7g27-q225-j894
  • github.com https://github.com/frappe/frappe/security/advisories/GHSA-7g27-q225-j894