CVE-2022-23055

Опубликовано: 22 июн. 2022

Источник: nvd

CVSS2: 5.5

EPSS Низкий

Описание

In ERPNext, versions v11.0.0-beta through v13.0.2 are vulnerable to Missing Authorization, in the chat rooms functionality. A low privileged attacker can send a direct message or a group message to any member or group, impersonating themselves as the administrator. The attacker can also read chat messages of groups that they do not belong to, and of other users.

Ссылки

https://github.com/frappe/frappe/blob/v13.0.2/frappe/chat/doctype/chat_message/chat_message.py#L134
Exploit
Third Party Advisory
https://github.com/frappe/frappe/blob/v13.0.2/frappe/chat/doctype/chat_message/chat_message.py#L155
Exploit
Third Party Advisory
https://www.mend.io/vulnerability-database/CVE-2022-23055
Exploit
Patch
Third Party Advisory
https://github.com/frappe/frappe/blob/v13.0.2/frappe/chat/doctype/chat_message/chat_message.py#L134
Exploit
Third Party Advisory
https://github.com/frappe/frappe/blob/v13.0.2/frappe/chat/doctype/chat_message/chat_message.py#L155
Exploit
Third Party Advisory
https://www.mend.io/vulnerability-database/CVE-2022-23055
Exploit
Patch
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:frappe:erpnext:*:*:*:*:*:*:*:*

Версия от 11.0.4 (включая) до 13.1.0 (исключая)

cpe:2.3:a:frappe:erpnext:11.0.3:beta1:*:*:*:*:*:*

cpe:2.3:a:frappe:erpnext:11.0.3:beta10:*:*:*:*:*:*

cpe:2.3:a:frappe:erpnext:11.0.3:beta11:*:*:*:*:*:*

cpe:2.3:a:frappe:erpnext:11.0.3:beta12:*:*:*:*:*:*

cpe:2.3:a:frappe:erpnext:11.0.3:beta13:*:*:*:*:*:*

cpe:2.3:a:frappe:erpnext:11.0.3:beta14:*:*:*:*:*:*

cpe:2.3:a:frappe:erpnext:11.0.3:beta15:*:*:*:*:*:*

cpe:2.3:a:frappe:erpnext:11.0.3:beta16:*:*:*:*:*:*

cpe:2.3:a:frappe:erpnext:11.0.3:beta17:*:*:*:*:*:*

cpe:2.3:a:frappe:erpnext:11.0.3:beta18:*:*:*:*:*:*

cpe:2.3:a:frappe:erpnext:11.0.3:beta19:*:*:*:*:*:*

cpe:2.3:a:frappe:erpnext:11.0.3:beta2:*:*:*:*:*:*

cpe:2.3:a:frappe:erpnext:11.0.3:beta20:*:*:*:*:*:*

cpe:2.3:a:frappe:erpnext:11.0.3:beta21:*:*:*:*:*:*

cpe:2.3:a:frappe:erpnext:11.0.3:beta22:*:*:*:*:*:*

cpe:2.3:a:frappe:erpnext:11.0.3:beta23:*:*:*:*:*:*

cpe:2.3:a:frappe:erpnext:11.0.3:beta24:*:*:*:*:*:*

cpe:2.3:a:frappe:erpnext:11.0.3:beta25:*:*:*:*:*:*

cpe:2.3:a:frappe:erpnext:11.0.3:beta26:*:*:*:*:*:*

cpe:2.3:a:frappe:erpnext:11.0.3:beta27:*:*:*:*:*:*

cpe:2.3:a:frappe:erpnext:11.0.3:beta28:*:*:*:*:*:*

cpe:2.3:a:frappe:erpnext:11.0.3:beta29:*:*:*:*:*:*

cpe:2.3:a:frappe:erpnext:11.0.3:beta3:*:*:*:*:*:*

cpe:2.3:a:frappe:erpnext:11.0.3:beta30:*:*:*:*:*:*

cpe:2.3:a:frappe:erpnext:11.0.3:beta31:*:*:*:*:*:*

cpe:2.3:a:frappe:erpnext:11.0.3:beta32:*:*:*:*:*:*

cpe:2.3:a:frappe:erpnext:11.0.3:beta33:*:*:*:*:*:*

cpe:2.3:a:frappe:erpnext:11.0.3:beta34:*:*:*:*:*:*

cpe:2.3:a:frappe:erpnext:11.0.3:beta35:*:*:*:*:*:*

cpe:2.3:a:frappe:erpnext:11.0.3:beta36:*:*:*:*:*:*

cpe:2.3:a:frappe:erpnext:11.0.3:beta37:*:*:*:*:*:*

cpe:2.3:a:frappe:erpnext:11.0.3:beta4:*:*:*:*:*:*

cpe:2.3:a:frappe:erpnext:11.0.3:beta5:*:*:*:*:*:*

cpe:2.3:a:frappe:erpnext:11.0.3:beta6:*:*:*:*:*:*

cpe:2.3:a:frappe:erpnext:11.0.3:beta7:*:*:*:*:*:*

cpe:2.3:a:frappe:erpnext:11.0.3:beta8:*:*:*:*:*:*

cpe:2.3:a:frappe:erpnext:11.0.3:beta9:*:*:*:*:*:*

EPSS

Процентиль: 53%

0.00301

Низкий

5.5 Medium

CVSS2

Дефекты

CWE-862

Связанные уязвимости

GHSA-gxgf-4cfv-cmq2

CVSS3: 5.4

github

больше 3 лет назад