Lucene search

PRIOn knowledge basePRION:CVE-2022-23055

HistoryJun 22, 2022 - 9:15 a.m.

Authorization

2022-06-2209:15:00

PRIOn knowledge base

www.prio-n.com

6.5 Medium

AI Score

Confidence

Low

5.5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:P/A:N

0.0004 Low

EPSS

Percentile

13.0%

JSON

In ERPNext, versions v11.0.0-beta through v13.0.2 are vulnerable to Missing Authorization, in the chat rooms functionality. A low privileged attacker can send a direct message or a group message to any member or group, impersonating themselves as the administrator. The attacker can also read chat messages of groups that they do not belong to, and of other users.

CPENameOperatorVersion
erpnexteq11.0.3 beta2
erpnexteq11.0.3 beta3
erpnexteq11.0.3 beta4
erpnexteq11.0.3 beta5
erpnexteq11.0.3 beta6
erpnexteq11.0.3 beta7
erpnexteq11.0.3 beta8
erpnexteq11.0.3 beta9
erpnexteq11.0.3 beta10
erpnexteq11.0.3 beta11

Name	Operator	Version
erpnext	eq	11.0.3 beta2
erpnext	eq	11.0.3 beta3
erpnext	eq	11.0.3 beta4
erpnext	eq	11.0.3 beta5
erpnext	eq	11.0.3 beta6
erpnext	eq	11.0.3 beta7
erpnext	eq	11.0.3 beta8
erpnext	eq	11.0.3 beta9
erpnext	eq	11.0.3 beta10
erpnext	eq	11.0.3 beta11

Rows per page:

1-10 of 391

References

github.com/frappe/frappe/blob/v13.0.2/frappe/chat/doctype/chat_message/chat_message.py

www.mend.io/vulnerability-database/CVE-2022-23055

6.5 Medium

AI Score

Confidence

Low

5.5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:P/A:N

0.0004 Low

EPSS

Percentile

13.0%

JSON

Related for PRION:CVE-2022-23055