CVE-2026-39385: CVE-2026-39385: kimlik doğrulama atlatma

Açıklama (NVD)

Frappe LMS is an open source learning management system. In version 2.51.0 and earlier, a user could bypass payment validation for courses by using unrelated batch. This has been patched in 2.52.0 with enrollment now validating that the batch is linked to course.

Özet bilgiler

CVSS v4.0

7.1 CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS

%0,37 (yüzdelik 31)

CWE

CWE-288

Yama

Yok / bilinmiyor

Kaynaklar

• NVD kaydı
• github.com
• CWE-288