Authentication flaw

2020-03-1819:15:00

PRIOn knowledge base

www.prio-n.com

7.6 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

51.3%

JSON

In core/doctype/prepared_report/prepared_report.py in Frappe 11 and 12, data files generated with Prepared Report were being stored as public files (no authentication is required to access; having a link is sufficient) instead of private files.

CPENameOperatorVersion
frappeeq12.0.0
frappeeq11.0.0

CPE	Name	Operator	Version
	frappe	eq	12.0.0
	frappe	eq	11.0.0

References

github.com/frappe/frappe/pull/8884

github.com/frappe/frappe/pull/8885