CVE-2024-27105

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

Frappe is a full-stack web application framework. Prior to versions 14.66.3 and 15.16.0, file permission can be bypassed using certain endpoints, granting less privileged users permission to delete or clone a file. Versions 14.66.3 and 15.16.0 contain a patch for this issue. No known workarounds are available.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-863

Affected software

No affected versions have been published.

Timeline

Published: Mar 21, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-271065.7Vulnerable data in transit in GE HealthCare EchoPAC products CVE-2024-271079.6Weak account password in GE HealthCare EchoPAC products CVE-2024-271086.8Non privileged access to critical file vulnerability in GE HealthCare EchoPAC products CVE-2024-271097.6Insufficiently protected credentials in GE HealthCare EchoPAC products CVE-2024-27118.8A vulnerability was found in Tenda AC10U 15.03.06.48. It has been rated as critical. Affected by this issue is the function addWifiMacFilter CVE-2024-271108.4Elevation of privilege vulnerability in GE HealthCare EchoPAC products CVE-2024-271129.8A unauthenticated SQL Injection has been found in the SO Planning tool that occurs when the public view setting is enabled. An attacker coul CVE-2024-271139.8An unauthenticated Insecure Direct Object Reference (IDOR) to the database has been found in the SO Planning tool that occurs when the publi CVE-2024-271149.8A unauthenticated Remote Code Execution (RCE) vulnerability is found in the SO Planning online planning tool. If the public view setting is CVE-2024-271159.8A unauthenticated Remote Code Execution (RCE) vulnerability is found in the SO Planning online planning tool. With this vulnerability, an at CVE-2024-27126.5A vulnerability, which was classified as critical, has been found in Campcodes Complete Online DJ Booking System 1.0. This issue affects som CVE-2024-271207.5A Local File Inclusion vulnerability has been found in ComfortKey, a product of Celsius Benelux. Using this vulnerability, an unauthenticate