LiveActive security incident?Get immediate response
CVE Record

CVE-2023-54345: Frappe Framework ERPNext 13.4.0 Remote Code Execution

Frappe Framework ERPNext 13.4.0 contains a sandbox escape vulnerability in RestrictedPython that allows authenticated users with System Manager role to execute arbitrary code by exploiting frame introspection. Attackers can create a server script via the /app/server-script endpoint and access the gi_frame attribute to traverse the call stack and invoke os.popen to execute system commands.

HighCVSS 8.8Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

CVE-2023-54345 is a high-severity remote code execution issue in Frappe Framework ERPNext 13.4.0. It requires an authenticated user with the System Manager role, but could let that user run operating-system commands from the application. This is most urgent where ERPNext administration roles are broadly assigned or exposed to less-trusted users.

Executive priority

Treat as high priority for any ERPNext 13.4.0 system with multiple administrators or broad System Manager access. The issue can affect full business data confidentiality and system integrity, but exploitation requires authenticated privileged application access based on the cited sources.

Technical view

The issue is described as a RestrictedPython sandbox escape in Frappe Framework ERPNext 13.4.0. An authenticated System Manager can abuse server-side scripting and frame introspection to escape intended restrictions and execute arbitrary code. The CVSS 3.1 score is 8.8, with low attack complexity, low privileges required, and high confidentiality, integrity, and availability impact.

Likely exposure

Exposure appears limited to ERPNext/Frappe Framework version 13.4.0 where Server Script functionality is available to authenticated System Manager users. Internet exposure increases risk, but the cited sources require valid credentials and that role. The provided sources do not name other affected versions.

Exploitation context

A public ExploitDB entry and VulnCheck advisory exist, indicating public exploit knowledge. CISA KEV status is not indicated in the provided data, so active exploitation should not be assumed from these sources alone.

Researcher notes

Evidence points to a sandbox escape in Frappe’s safe execution path and Server Script feature. Public exploit references exist, but the bundle does not provide a vendor fix statement or broader version range. Avoid assuming exploitation in the wild without KEV listing or corroborating reporting.

Mitigation direction

  • Identify any ERPNext/Frappe Framework 13.4.0 deployments.
  • Check Frappe/ERPNext vendor guidance for fixed versions or official mitigations.
  • Upgrade if the vendor identifies a corrected release for your branch.
  • Restrict System Manager role to trusted administrators only.
  • Disable or tightly restrict Server Script functionality if not operationally required.
  • Review recent administrative changes and server script activity.

Validation and detection

  • Inventory ERPNext and Frappe versions across production and staging.
  • Confirm whether any instance is running version 13.4.0.
  • List users assigned the System Manager role.
  • Review Server Script records for unexpected or recently modified entries.
  • Check application and host logs for unusual child process activity.
  • Verify administrative access is protected by MFA and least privilege.
Prepared
Confidence
medium
Sources
6

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cwe · medium confidence lookup

CWE-94: Code execution behavior lookup

Code execution and unsafe deserialization weaknesses often justify reviewing execution behavior and process telemetry. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.

Open ATT&CK lookup
description · low confidence lookup

Execution behavior lookup

The CVE wording references code or command execution, so execution technique review may help defensive triage. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.

Open ATT&CK lookup
description · low confidence lookup

Privilege behavior lookup

The CVE wording references privilege impact, so privilege escalation and authorization behavior review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2023-54345 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
High
CVSS
8.8 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

2CVSS vectors
3Timeline events
1ADP providers
8Source links

SSVC decision data

CISA-ADPCISA Coordinator
Timestamp
Version
2.0.3
Exploitation: pocAutomatable: noTechnical Impact: total

CVSS vector scores

2 official scores

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
8.8CVSS 3.1HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H2.85.9VulnCheck
8.7CVSS 4.0HighCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N——VulnCheck

Vulnerability scoring details

Base CVSS 4.0 score

8.7High
CVSS 4.0 vector shape for CVE-2023-54345Attack VectorAttack ComplexityAttack RequirementsPrivileges RequiredUser InteractionVS ConfidentialityVS IntegrityVS AvailabilitySS ConfidentialitySS IntegritySS Availability

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Attack Requirements
NonePresent
Privileges Required
NoneLowHigh
User Interaction
NonePassiveActive
VS Confidentiality
HighLowNone
VS Integrity
HighLowNone
VS Availability
HighLowNone
SS Confidentiality
HighLowNone
SS Integrity
HighLowNone
SS Availability
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CISA-ADPCISA ADP Vulnrichment
other:ssvc

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
ErpnextFrappe Framework (ERPNext)13.4.0Listed
Weakness

CWE details

CWE-94

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.