5.5

CVE-2022-23055

Exploit

ERPNext - Improper user access conrol

In ERPNext, versions v11.0.0-beta through v13.0.2 are vulnerable to Missing Authorization, in the chat rooms functionality. A low privileged attacker can send a direct message or a group message to any member or group, impersonating themselves as the administrator. The attacker can also read chat messages of groups that they do not belong to, and of other users.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Frappe ≫ Erpnext Version >= 11.0.4 < 13.1.0
Frappe ≫ Erpnext Version 11.0.3 Update beta1
Frappe ≫ Erpnext Version 11.0.3 Update beta10
Frappe ≫ Erpnext Version 11.0.3 Update beta11
Frappe ≫ Erpnext Version 11.0.3 Update beta12
Frappe ≫ Erpnext Version 11.0.3 Update beta13
Frappe ≫ Erpnext Version 11.0.3 Update beta14
Frappe ≫ Erpnext Version 11.0.3 Update beta15
Frappe ≫ Erpnext Version 11.0.3 Update beta16
Frappe ≫ Erpnext Version 11.0.3 Update beta17
Frappe ≫ Erpnext Version 11.0.3 Update beta18
Frappe ≫ Erpnext Version 11.0.3 Update beta19
Frappe ≫ Erpnext Version 11.0.3 Update beta2
Frappe ≫ Erpnext Version 11.0.3 Update beta20
Frappe ≫ Erpnext Version 11.0.3 Update beta21
Frappe ≫ Erpnext Version 11.0.3 Update beta22
Frappe ≫ Erpnext Version 11.0.3 Update beta23
Frappe ≫ Erpnext Version 11.0.3 Update beta24
Frappe ≫ Erpnext Version 11.0.3 Update beta25
Frappe ≫ Erpnext Version 11.0.3 Update beta26
Frappe ≫ Erpnext Version 11.0.3 Update beta27
Frappe ≫ Erpnext Version 11.0.3 Update beta28
Frappe ≫ Erpnext Version 11.0.3 Update beta29
Frappe ≫ Erpnext Version 11.0.3 Update beta3
Frappe ≫ Erpnext Version 11.0.3 Update beta30
Frappe ≫ Erpnext Version 11.0.3 Update beta31
Frappe ≫ Erpnext Version 11.0.3 Update beta32
Frappe ≫ Erpnext Version 11.0.3 Update beta33
Frappe ≫ Erpnext Version 11.0.3 Update beta34
Frappe ≫ Erpnext Version 11.0.3 Update beta35
Frappe ≫ Erpnext Version 11.0.3 Update beta36
Frappe ≫ Erpnext Version 11.0.3 Update beta37
Frappe ≫ Erpnext Version 11.0.3 Update beta4
Frappe ≫ Erpnext Version 11.0.3 Update beta5
Frappe ≫ Erpnext Version 11.0.3 Update beta6
Frappe ≫ Erpnext Version 11.0.3 Update beta7
Frappe ≫ Erpnext Version 11.0.3 Update beta8
Frappe ≫ Erpnext Version 11.0.3 Update beta9
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 1.16% 0.646
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 5.5 8 4.9
AV:N/AC:L/Au:S/C:P/I:P/A:N
CWE-862 Missing Authorization

The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

https://github.com/frappe/frappe/blob/v13.0.2/frappe/chat/doctype/chat_message/chat_message.py#L134
Third Party Advisory
Exploit
https://github.com/frappe/frappe/blob/v13.0.2/frappe/chat/doctype/chat_message/chat_message.py#L155
Third Party Advisory
Exploit
https://www.mend.io/vulnerability-database/CVE-2022-23055
Patch
Third Party Advisory
Exploit