5.5

CVE-2022-23055

Exploit
In ERPNext, versions v11.0.0-beta through v13.0.2 are vulnerable to Missing Authorization, in the chat rooms functionality. A low privileged attacker can send a direct message or a group message to any member or group, impersonating themselves as the administrator. The attacker can also read chat messages of groups that they do not belong to, and of other users.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Frappe ≫ Erpnext Version >= 11.0.4 < 13.1.0
Frappe ≫ Erpnext Version11.0.3 Updatebeta1
Frappe ≫ Erpnext Version11.0.3 Updatebeta10
Frappe ≫ Erpnext Version11.0.3 Updatebeta11
Frappe ≫ Erpnext Version11.0.3 Updatebeta12
Frappe ≫ Erpnext Version11.0.3 Updatebeta13
Frappe ≫ Erpnext Version11.0.3 Updatebeta14
Frappe ≫ Erpnext Version11.0.3 Updatebeta15
Frappe ≫ Erpnext Version11.0.3 Updatebeta16
Frappe ≫ Erpnext Version11.0.3 Updatebeta17
Frappe ≫ Erpnext Version11.0.3 Updatebeta18
Frappe ≫ Erpnext Version11.0.3 Updatebeta19
Frappe ≫ Erpnext Version11.0.3 Updatebeta2
Frappe ≫ Erpnext Version11.0.3 Updatebeta20
Frappe ≫ Erpnext Version11.0.3 Updatebeta21
Frappe ≫ Erpnext Version11.0.3 Updatebeta22
Frappe ≫ Erpnext Version11.0.3 Updatebeta23
Frappe ≫ Erpnext Version11.0.3 Updatebeta24
Frappe ≫ Erpnext Version11.0.3 Updatebeta25
Frappe ≫ Erpnext Version11.0.3 Updatebeta26
Frappe ≫ Erpnext Version11.0.3 Updatebeta27
Frappe ≫ Erpnext Version11.0.3 Updatebeta28
Frappe ≫ Erpnext Version11.0.3 Updatebeta29
Frappe ≫ Erpnext Version11.0.3 Updatebeta3
Frappe ≫ Erpnext Version11.0.3 Updatebeta30
Frappe ≫ Erpnext Version11.0.3 Updatebeta31
Frappe ≫ Erpnext Version11.0.3 Updatebeta32
Frappe ≫ Erpnext Version11.0.3 Updatebeta33
Frappe ≫ Erpnext Version11.0.3 Updatebeta34
Frappe ≫ Erpnext Version11.0.3 Updatebeta35
Frappe ≫ Erpnext Version11.0.3 Updatebeta36
Frappe ≫ Erpnext Version11.0.3 Updatebeta37
Frappe ≫ Erpnext Version11.0.3 Updatebeta4
Frappe ≫ Erpnext Version11.0.3 Updatebeta5
Frappe ≫ Erpnext Version11.0.3 Updatebeta6
Frappe ≫ Erpnext Version11.0.3 Updatebeta7
Frappe ≫ Erpnext Version11.0.3 Updatebeta8
Frappe ≫ Erpnext Version11.0.3 Updatebeta9
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.3% 0.53
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 5.5 8 4.9
AV:N/AC:L/Au:S/C:P/I:P/A:N
CWE-862 Missing Authorization

The product does not perform an authorization check when an actor attempts to access a resource or perform an action.