← Retour aux CVEs

CVE-2022-23055

N/A

Description

In ERPNext, versions v11.0.0-beta through v13.0.2 are vulnerable to Missing Authorization, in the chat rooms functionality. A low privileged attacker can send a direct message or a group message to any member or group, impersonating themselves as the administrator. The attacker can also read chat messages of groups that they do not belong to, and of other users.

Details CVE

Score CVSS v3.1N/A

Publie6/22/2022

Derniere modification11/21/2024

Sourcenvd

Observations honeypot0

Produits affectes

frappe:erpnext

Faiblesses (CWE)

CWE-862

References

https://github.com/frappe/frappe/blob/v13.0.2/frappe/chat/doctype/chat_message/chat_message.py#L134(vulnerabilitylab@mend.io)

https://github.com/frappe/frappe/blob/v13.0.2/frappe/chat/doctype/chat_message/chat_message.py#L155(vulnerabilitylab@mend.io)

https://www.mend.io/vulnerability-database/CVE-2022-23055(vulnerabilitylab@mend.io)

https://github.com/frappe/frappe/blob/v13.0.2/frappe/chat/doctype/chat_message/chat_message.py#L134(af854a3a-2127-422b-91ae-364da2661108)

https://github.com/frappe/frappe/blob/v13.0.2/frappe/chat/doctype/chat_message/chat_message.py#L155(af854a3a-2127-422b-91ae-364da2661108)

https://www.mend.io/vulnerability-database/CVE-2022-23055(af854a3a-2127-422b-91ae-364da2661108)

Correlations IOC

Aucune correlation enregistree

This product uses data from the NVD API but is not endorsed or certified by the NVD.