Frappe Server-Side Request Forgery Vulnerability

A server-side request forgery (SSRF) vulnerability has been identified in the Frappe web application framework, affecting versions prior to 14.100.1, 15.100.0, and 16.6.0. This vulnerability allows a malicious user to send a crafted request to an endpoint, which could then lead to the server making an HTTP call to a service of the user's choice.

Impact

Exploitation of this vulnerability could allow an authenticated user to make the server initiate HTTP requests to arbitrary services, potentially leading to unauthorized data access or interaction with internal services.

Remediation

Users are advised to upgrade to Frappe versions 14.100.1, 15.100.0, or 16.6.0.