CVEvulnerability
CVE-2022-23055
5.5 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2022-06-22
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 5.5 MEDIUM — AV:N/AC:L/Au:S/C:P/I:P/A:N
- Weaknesses
- CWE-862
Description
In ERPNext, versions v11.0.0-beta through v13.0.2 are vulnerable to Missing Authorization, in the chat rooms functionality. A low privileged attacker can send a direct message or a group message to any member or group, impersonating themselves as the administrator. The attacker can also read chat messages of groups that they do not belong to, and of other users.
Affected configurations
• frappe erpnext (>= 11.0.4 < 13.1.0)
• frappe erpnext 11.0.3
Related
Weakness · CWE (1)
- CWE-862 Missing Authorization weakness
References
- https://github.com/frappe/frappe/blob/v13.0.2/frappe/chat/doctype/chat_message/chat_message.py#L134 Exploit, Third Party Advisory
- https://github.com/frappe/frappe/blob/v13.0.2/frappe/chat/doctype/chat_message/chat_message.py#L155 Exploit, Third Party Advisory
- https://www.mend.io/vulnerability-database/CVE-2022-23055 Exploit, Patch, Third Party Advisory
- https://github.com/frappe/frappe/blob/v13.0.2/frappe/chat/doctype/chat_message/chat_message.py#L134 Exploit, Third Party Advisory
- https://github.com/frappe/frappe/blob/v13.0.2/frappe/chat/doctype/chat_message/chat_message.py#L155 Exploit, Third Party Advisory
- https://www.mend.io/vulnerability-database/CVE-2022-23055 Exploit, Patch, Third Party Advisory