CVE-2022-23055 - CVE House

Back to Database

Status published Medium CVE-2022-23055

ERPNext - Improper user access conrol

5.5 CVSS

Vulnerability Description

In ERPNext, versions v11.0.0-beta through v13.0.2 are vulnerable to Missing Authorization, in the chat rooms functionality. A low privileged attacker can send a direct message or a group message to any member or group, impersonating themselves as the administrator. The attacker can also read chat messages of groups that they do not belong to, and of other users.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2022-23055

Check My Exposure

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

Mend Vulnerability Research Team (MVR)

References

More from frappe

View All →

Certain Frappe requests are vulnerable to Path Traversal

Frappe may be vulnerable remote code execution due to server-side template injection

Frappe CRM vulnerable to authenticated XSS via website field

Frappe Authenticated Users can Execute JavaScript through its Job Form

Frappe authenticated users can execute XSS through form description fields

Affected Vendor

frappe

View all reports →

Affected Software

frappe

Vulnerable Versions:

v11.0.3-beta.1, unspecified

Timeline

Official Publish: June 22nd, 2022

Last Modified: September 16th, 2024

Added to House: July 21st, 2026

CVSS Vectors

Weaknesses (CWE)

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application

T1068 Exploitation for Privilege Escalation

Privilege Escalation

T1078 Valid Accounts

T1531 Account Access Removal