Srtsubmersionai

**Name of the Vulnerable Software and Affected Versions** Frappe ERPNext versions prior to 16.34.1 **Description** Accounts Managers can invoke non-whitelisted internal server-side methods and read their return values. This occurs because the software fails to validate that the `calculation formula` values within the Financial Report Template reference whitelisted methods before they are passed to the `frappe.call()` function. An attacker can supply arbitrary dotted Python paths to execute these unauthorized methods. **Recommendations** Update to version 16.34.1 or later.