Frappe EUVD-2025-211073

Requires that the Frappe instance has LDAP integration enabled/configured for directory or authentication lookups - this is the attack requirement reflected by CVSS AT:P, and instances not using LDAP are not exploitable. The attacker must be able to reach one of the specific endpoints that pass user-supplied parameters into LDAP queries without sanitization; no authentication is required per PR:N and no user interaction per UI:N. Limiting factors: exploitation is confined to directory-query manipulation (confidentiality-oriented, VI:N/VA:N) and only affects deployments with the LDAP feature active, substantially narrowing the real-world exposed population below the raw network-reachable figure.

This is a medium-severity LDAP injection (CWE-90) rated CVSS 4.0 6.3 with vector AV:N/AC:L/AT:P/PR:N/UI:N and a confidentiality-only impact (VC:L, VI:N, VA:N, no scope change). The network vector and PR:N indicate a remote, unauthenticated reachable flaw, but the AT:P (Attack Requirements: Present) metric is the critical qualifier: exploitation depends on Frappe actually being configured to use LDAP for directory/authentication queries - it is not a universally exploitable condition. There is no EPSS score provided, the CVE is NOT on the CISA KEV list, and no public proof-of-concept is referenced, so there is no public exploit identified at time of analysis. Weighing the signals: the CVSS confidentiality-limited impact, the deployment-dependent attack requirement, and the absence of KEV/POC/EPSS data together point to a genuine but moderate, non-urgent issue rather than a top-tier emergency - it warrants patching on a normal remediation cycle for Frappe/ERPNext instances that use LDAP, and is lower priority for instances that do not. No conflicting signals are present, but note the input lacks EPSS entirely, so exploitation-probability cannot be quantified.

A remote attacker sends requests to a Frappe endpoint that passes user-supplied parameters unsanitized into an LDAP query, injecting crafted LDAP filter syntax (e.g., wildcards or boolean operators) to alter the directory lookup. By manipulating the filter the attacker can broaden or redirect the query to enumerate directory entries or influence authentication-related lookups. No public exploit code is referenced, and exploitation requires the target to have LDAP integration configured (reflected by the CVSS AT:P metric).