CVE-2025-62778
📋 TL;DR
Frappe Learning versions 2.39.1 and earlier contain a direct object reference vulnerability where students can access quiz forms by knowing the URL, bypassing intended access controls. This affects all deployments using vulnerable versions of the learning management system.
💻 Affected Systems
- Frappe Learning (LMS)
📦 What is this software?
Learning by Frappe
⚠️ Risk & Real-World Impact
Worst Case
Students could access and potentially modify quiz content, view answers, or manipulate grades before or during assessments, compromising academic integrity.
Likely Case
Students discover and share quiz URLs to preview questions or answers before taking assessments, gaining unfair advantage.
If Mitigated
With proper access controls and monitoring, impact is limited to minor information disclosure with no data modification.
🎯 Exploit Status
Exploitation requires student-level authentication and knowledge of quiz URLs, which could be discovered through enumeration or information sharing.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.39.2 or later
Vendor Advisory: https://github.com/frappe/lms/security/advisories/GHSA-8xvv-6v89-xxgx
Restart Required: No
Instructions:
1. Update Frappe Learning to version 2.39.2 or later. 2. Apply the commit 8749e21744547ae32f729bde05c854113e126750 if manual patching is needed.
🔧 Temporary Workarounds
Implement URL access controls
allAdd middleware or application-level checks to validate user permissions before serving quiz forms.
🧯 If You Can't Patch
- Implement network segmentation to restrict student access to quiz management interfaces.
- Enable detailed logging of all quiz form access attempts and monitor for unauthorized access patterns.
🔍 How to Verify
Check if Vulnerable:
Check if Frappe Learning version is 2.39.1 or earlier. Attempt to access a quiz form URL as a student user without proper permissions.Check Version:
Check the Frappe Learning version in the application settings or via the Frappe bench command: bench versionVerify Fix Applied:
After updating, verify that students cannot access quiz forms via direct URLs without proper authorization.📡 Detection & Monitoring
Log Indicators:
- Multiple failed authorization attempts for quiz forms
- Student users accessing quiz management URLs
Network Indicators:
- Unusual patterns of HTTP GET requests to quiz endpoints from student IP addresses
SIEM Query:
source="frappe_logs" AND (url_path="/api/method/frappe.lms.doctype.lms_quiz.lms_quiz" OR url_path CONTAINS "quiz") AND user_role="Student" AND http_method="GET"