Lucene search
TalosCVELIST:CVE-2020-6145HistoryAug 10, 2020 - 1:10 p.m.
CVE-2020-6145
2020-08-1013:10:24
CWE-89
talos
www.cve.org
6
sql injection
erpnext
http request
vulnerability
CVSS3
6.4
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
CHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
EPSS
0.001
Percentile
29.0%
An SQL injection vulnerability exists in the frappe.desk.reportview.get functionality of ERPNext 11.1.38. A specially crafted HTTP request can cause an SQL injection. An attacker can make an authenticated HTTP request to trigger this vulnerability.
CNA Affected
[
{
"product": "ERPNext",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "ERPNext 11.1.38"
}
]
}
]Related
nvd
nvd
CVE-2020-6145
2020-08-10 14:15:13
prion
prion
Sql injection
2020-08-10 14:15:00
osv
osv
CVE-2020-6145
2020-08-10 14:15:13
cve
cve
CVE-2020-6145
2020-08-10 14:15:13
talos
talos
ERPNext frappe.desk.reportview.get SQL injection vulnerability
2020-08-18 00:00:00
CVSS3
6.4
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
CHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
EPSS
0.001
Percentile
29.0%
Related for CVELIST:CVE-2020-6145