CVE-2022-23055
ERPNext - Improper user access conrol
- State
- Published
- Severity
- Not scored
- Published
- Jun 22, 2022
- Updated
- Sep 16, 2024
- Reserved
- Jan 10, 2022
Description
In ERPNext, versions v11.0.0-beta through v13.0.2 are vulnerable to Missing Authorization, in the chat rooms functionality. A low privileged attacker can send a direct message or a group message to any member or group, impersonating themselves as the administrator. The attacker can also read chat messages of groups that they do not belong to, and of other users.
Scores
The record has no CVSS score.
Weaknesses
- CWE-862 Missing Authorization
Affected Products
| Product | Versions |
|---|---|
frappefrappe |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.