Vulnerability Database

299,584

Total vulnerabilities in the database

CVE-2022-23055

In ERPNext, versions v11.0.0-beta through v13.0.2 are vulnerable to Missing Authorization, in the chat rooms functionality. A low privileged attacker can send a direct message or a group message to any member or group, impersonating themselves as the administrator. The attacker can also read chat messages of groups that they do not belong to, and of other users.

  • Published: Jun 22, 2022
  • Updated: Apr 14, 2023
  • CVE: CVE-2022-23055
  • Severity: Medium
  • Exploit:

CVSS v2:

  • Severity: Medium
  • Score: 5.5
  • AV:N/AC:L/Au:S/C:P/I:P/A:N

CWEs:

Software From Fixed in
frappe / erpnext 11.0.3-beta2 11.0.3-beta2.x
frappe / erpnext 11.0.3-beta3 11.0.3-beta3.x
frappe / erpnext 11.0.3-beta4 11.0.3-beta4.x
frappe / erpnext 11.0.3-beta5 11.0.3-beta5.x
frappe / erpnext 11.0.3-beta6 11.0.3-beta6.x
frappe / erpnext 11.0.3-beta7 11.0.3-beta7.x
frappe / erpnext 11.0.3-beta8 11.0.3-beta8.x
frappe / erpnext 11.0.3-beta9 11.0.3-beta9.x
frappe / erpnext 11.0.3-beta10 11.0.3-beta10.x
frappe / erpnext 11.0.3-beta11 11.0.3-beta11.x
frappe / erpnext 11.0.3-beta12 11.0.3-beta12.x
frappe / erpnext 11.0.3-beta13 11.0.3-beta13.x
frappe / erpnext 11.0.3-beta14 11.0.3-beta14.x
frappe / erpnext 11.0.3-beta15 11.0.3-beta15.x
frappe / erpnext 11.0.3-beta16 11.0.3-beta16.x
frappe / erpnext 11.0.3-beta17 11.0.3-beta17.x
frappe / erpnext 11.0.3-beta18 11.0.3-beta18.x
frappe / erpnext 11.0.3-beta19 11.0.3-beta19.x
frappe / erpnext 11.0.3-beta20 11.0.3-beta20.x
frappe / erpnext 11.0.3-beta21 11.0.3-beta21.x
frappe / erpnext 11.0.3-beta22 11.0.3-beta22.x
frappe / erpnext 11.0.3-beta23 11.0.3-beta23.x
frappe / erpnext 11.0.3-beta24 11.0.3-beta24.x
frappe / erpnext 11.0.3-beta25 11.0.3-beta25.x
frappe / erpnext 11.0.3-beta26 11.0.3-beta26.x
frappe / erpnext 11.0.3-beta27 11.0.3-beta27.x
frappe / erpnext 11.0.3-beta28 11.0.3-beta28.x
frappe / erpnext 11.0.3-beta29 11.0.3-beta29.x
frappe / erpnext 11.0.4 13.1.0
frappe / erpnext 11.0.3-beta30 11.0.3-beta30.x
frappe / erpnext 11.0.3-beta31 11.0.3-beta31.x
frappe / erpnext 11.0.3-beta32 11.0.3-beta32.x
frappe / erpnext 11.0.3-beta33 11.0.3-beta33.x
frappe / erpnext 11.0.3-beta34 11.0.3-beta34.x
frappe / erpnext 11.0.3-beta35 11.0.3-beta35.x
frappe / erpnext 11.0.3-beta36 11.0.3-beta36.x
frappe / erpnext 11.0.3-beta37 11.0.3-beta37.x
frappe / erpnext 11.0.3-beta1 11.0.3-beta1.x