CVE-2018-20061

Опубликовано: 11 дек. 2018

Источник: nvd

CVSS3: 7.5

CVSS2: 5

EPSS Низкий

Описание

A SQL injection issue was discovered in ERPNext 10.x and 11.x through 11.0.3-beta.29. This attack is only available to a logged-in user; however, many ERPNext sites allow account creation via the web. No special privileges are needed to conduct the attack. By calling a JavaScript function that calls a server-side Python function with carefully chosen arguments, a SQL attack can be carried out which allows SQL queries to be constructed to return any columns from any tables in the database. This is related to /api/resource/Item?fields= URIs, frappe.get_list, and frappe.call.

Ссылки

https://github.com/frappe/erpnext/issues/15337
Third Party Advisory
https://github.com/frappe/erpnext/issues/15337
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:frappe:erpnext:*:*:*:*:*:*:*:*

Версия от 10.0.0 (включая) до 10.1.76 (включая)

cpe:2.3:a:frappe:erpnext:*:*:*:*:*:*:*:*

Версия от 11.0.0 (включая) до 11.0.3 (исключая)

cpe:2.3:a:frappe:erpnext:11.0.3:beta10:*:*:*:*:*:*

cpe:2.3:a:frappe:erpnext:11.0.3:beta11:*:*:*:*:*:*

cpe:2.3:a:frappe:erpnext:11.0.3:beta12:*:*:*:*:*:*

cpe:2.3:a:frappe:erpnext:11.0.3:beta13:*:*:*:*:*:*

cpe:2.3:a:frappe:erpnext:11.0.3:beta14:*:*:*:*:*:*

cpe:2.3:a:frappe:erpnext:11.0.3:beta15:*:*:*:*:*:*

cpe:2.3:a:frappe:erpnext:11.0.3:beta16:*:*:*:*:*:*

cpe:2.3:a:frappe:erpnext:11.0.3:beta17:*:*:*:*:*:*

cpe:2.3:a:frappe:erpnext:11.0.3:beta18:*:*:*:*:*:*

cpe:2.3:a:frappe:erpnext:11.0.3:beta19:*:*:*:*:*:*

cpe:2.3:a:frappe:erpnext:11.0.3:beta2:*:*:*:*:*:*

cpe:2.3:a:frappe:erpnext:11.0.3:beta20:*:*:*:*:*:*

cpe:2.3:a:frappe:erpnext:11.0.3:beta21:*:*:*:*:*:*

cpe:2.3:a:frappe:erpnext:11.0.3:beta22:*:*:*:*:*:*

cpe:2.3:a:frappe:erpnext:11.0.3:beta23:*:*:*:*:*:*

cpe:2.3:a:frappe:erpnext:11.0.3:beta24:*:*:*:*:*:*

cpe:2.3:a:frappe:erpnext:11.0.3:beta25:*:*:*:*:*:*

cpe:2.3:a:frappe:erpnext:11.0.3:beta26:*:*:*:*:*:*

cpe:2.3:a:frappe:erpnext:11.0.3:beta27:*:*:*:*:*:*

cpe:2.3:a:frappe:erpnext:11.0.3:beta28:*:*:*:*:*:*

cpe:2.3:a:frappe:erpnext:11.0.3:beta29:*:*:*:*:*:*

cpe:2.3:a:frappe:erpnext:11.0.3:beta3:*:*:*:*:*:*

cpe:2.3:a:frappe:erpnext:11.0.3:beta4:*:*:*:*:*:*

cpe:2.3:a:frappe:erpnext:11.0.3:beta5:*:*:*:*:*:*

cpe:2.3:a:frappe:erpnext:11.0.3:beta6:*:*:*:*:*:*

cpe:2.3:a:frappe:erpnext:11.0.3:beta7:*:*:*:*:*:*

cpe:2.3:a:frappe:erpnext:11.0.3:beta8:*:*:*:*:*:*

cpe:2.3:a:frappe:erpnext:11.0.3:beta9:*:*:*:*:*:*

EPSS

Процентиль: 50%

0.00264

Низкий

7.5 High

CVSS3

5 Medium

CVSS2

Дефекты

CWE-89

Связанные уязвимости

GHSA-66f4-g2vx-q58x