CVE-2022-23055
Assigner: Mend
Published: 2022-03-09T00:00:00
State: PUBLISHED
affected: product: frappe
vendor: frappe
versions: lessThan: unspecified
status: affected
version: v11.0.3-beta.1
versionType: custom
lessThanOrEqual: v13.14.1
status: affected
version: unspecified
versionType: custom
credits: value: Mend Vulnerability Research Team (MVR)
datePublic: 2022-03-09T00:00:00
descriptions: value: In ERPNext, versions v11.0.0-beta through v13.0.2 are vulnerable to Missing Authorization, in the chat rooms functionality. A low privileged attacker can send a direct message or a group message to any member or group, impersonating themselves as the administrator. The attacker can also read chat messages of groups that they do not belong to, and of other users.
metrics: other: content: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.4
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
version: 3.1
type: unknown
problemTypes: descriptions: cweId: CWE-862
description: CWE-862 Missing Authorization
type: CWE
solutions: value: Update version to v13.1.0 or later
source: advisory: https://www.mend.io/vulnerability-database/
discovery: UNKNOWN
title: ERPNext - Improper user access conrol
x_generator: engine: Vulnogram 0.0.9