Frappe Prepared Report / Query Report bypass subject, owner and row-level permission checks to read other users' report data

Frappe Prepared Report / Query Report Bypass Permission Checks to Read Other Users' Report Data Vulnerability Overview Query Report in Frappe Framework supports background pre-generation Prepared Report: the query is executed with the initiating user's privileges and the result is persisted for...

EUVD-2019-11069

Malware in sbrugna...

Frappe Technologies Frappe Information Disclosure Vulnerability

Frappe Technologies Frappe is a metadata-driven full-stack web application framework based on Python and JavaScript from Frappe Technologies, India. An information disclosure vulnerability exists in Frappe Technologies Frappe versions 11 and 12, which originates in the...

CVE-2019-20529

In core/doctype/preparedreport/preparedreport.py in Frappe 11 and 12, data files generated with Prepared Report were being stored as public files no authentication is required to access; having a link is sufficient instead of private files...

CVE-2019-20529

In core/doctype/preparedreport/preparedreport.py in Frappe 11 and 12, data files generated with Prepared Report were being stored as public files no authentication is required to access; having a link is sufficient instead of private files...

CVE-2019-20529

CVE-2019-20529 affects Frappe 11 and 12: in core/doctype/prepared_report/prepared_report.py, data files generated by Prepared Report were stored as public files (no authentication required) instead of private files, enabling information disclosure via a link. The issue is documented across multip...

CVE-2019-20529

In core/doctype/preparedreport/preparedreport.py in Frappe 11 and 12, data files generated with Prepared Report were being stored as public files no authentication is required to access; having a link is sufficient instead of private files...

CVE-2019-20529

In core/doctype/preparedreport/preparedreport.py in Frappe 11 and 12, data files generated with Prepared Report were being stored as public files no authentication is required to access; having a link is sufficient instead of private files...

PT-2020-10505

Name of the Vulnerable Software and Affected Versions Frappe versions 11 through 12 Description The issue concerns the storage of data files generated with Prepared Report in Frappe. These files were being stored as public files, which means no authentication is required to access them; having a...