CVE-2022-23055
5.5 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
SINGLE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:L/Au:S/C:P/I:P/A:N
6.5 Medium
AI Score
Confidence
High
0.001 Low
EPSS
Percentile
25.2%
In ERPNext, versions v11.0.0-beta through v13.0.2 are vulnerable to Missing Authorization, in the chat rooms functionality. A low privileged attacker can send a direct message or a group message to any member or group, impersonating themselves as the administrator. The attacker can also read chat messages of groups that they do not belong to, and of other users.
Affected configurations
| CPE | Name | Operator | Version |
|---|---|---|---|
| frappe:erpnext | frappe erpnext | lt | 13.1.0 |
| frappe:erpnext | frappe erpnext | eq | 11.0.3 |
CNA Affected
[
{
"product": "frappe",
"vendor": "frappe",
"versions": [
{
"lessThan": "unspecified",
"status": "affected",
"version": "v11.0.3-beta.1",
"versionType": "custom"
},
{
"lessThanOrEqual": "v13.14.1",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
}
]References
Social References
More
Related
5.5 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
SINGLE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:L/Au:S/C:P/I:P/A:N
6.5 Medium
AI Score
Confidence
High
0.001 Low
EPSS
Percentile
25.2%