CVE-2019-20529

2020-03-1819:15:17

Google

osv.dev

6.8 Medium

AI Score

Confidence

Low

0.001 Low

EPSS

Percentile

51.3%

JSON

In core/doctype/prepared_report/prepared_report.py in Frappe 11 and 12, data files generated with Prepared Report were being stored as public files (no authentication is required to access; having a link is sufficient) instead of private files.

CPENameOperatorVersion
frappeeq5.0.26
frappeeq7.0.32
frappeeq10.0.6
frappeeq6.4.4
frappeeq10.1.17
frappeeq11.1.18
frappeeq10.1.49-beta.1
frappeeq10.1.64
frappeeq6.27.17
frappeeq8.3.0

Name	Operator	Version
frappe	eq	5.0.26
frappe	eq	7.0.32
frappe	eq	10.0.6
frappe	eq	6.4.4
frappe	eq	10.1.17
frappe	eq	11.1.18
frappe	eq	10.1.49-beta.1
frappe	eq	10.1.64
frappe	eq	6.27.17
frappe	eq	8.3.0