CVE-2022-23055: frappe erpnext

csirt@kutim:~/threat-intel/cve/CVE-2022-23055

CVSS 5.5 · Medium EPSS 1,2%

Kerentanan Missing Authorization pada frappe erpnext. Skor CVSS 2.0 5.5 (Medium) menurut NVD.

Deskripsi (NVD)

In ERPNext, versions v11.0.0-beta through v13.0.2 are vulnerable to Missing Authorization, in the chat rooms functionality. A low privileged attacker can send a direct message or a group message to any member or group, impersonating themselves as the administrator. The attacker can also read chat messages of groups that they do not belong to, and of other users.

Rincian

Terbit di NVD: 22 Juni 2022
Terakhir diubah: 17 Juni 2026
Status NVD: Modified
CVSS 2.0: 5.5 (Medium), sumber NVD
AV:N/AC:L/Au:S/C:P/I:P/A:N
Jenis kelemahan (CWE): CWE-862: Missing Authorization
EPSS (30 hari): 1,2% peluang dieksploitasi; lebih tinggi dari 67,3% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
frappe	erpnext	Versi 11.0.4 hingga sebelum 13.1.0
frappe	erpnext	Versi 11.0.3 beta1
frappe	erpnext	Versi 11.0.3 beta10
frappe	erpnext	Versi 11.0.3 beta11
frappe	erpnext	Versi 11.0.3 beta12
frappe	erpnext	Versi 11.0.3 beta13
frappe	erpnext	Versi 11.0.3 beta14
frappe	erpnext	Versi 11.0.3 beta15
frappe	erpnext	Versi 11.0.3 beta16
frappe	erpnext	Versi 11.0.3 beta17
frappe	erpnext	Versi 11.0.3 beta18
frappe	erpnext	Versi 11.0.3 beta19
frappe	erpnext	Versi 11.0.3 beta2
frappe	erpnext	Versi 11.0.3 beta20
frappe	erpnext	Versi 11.0.3 beta21
frappe	erpnext	Versi 11.0.3 beta22
frappe	erpnext	Versi 11.0.3 beta23
frappe	erpnext	Versi 11.0.3 beta24
frappe	erpnext	Versi 11.0.3 beta25
frappe	erpnext	Versi 11.0.3 beta26
frappe	erpnext	Versi 11.0.3 beta27
frappe	erpnext	Versi 11.0.3 beta28
frappe	erpnext	Versi 11.0.3 beta29
frappe	erpnext	Versi 11.0.3 beta3
frappe	erpnext	Versi 11.0.3 beta30
frappe	erpnext	Versi 11.0.3 beta31
frappe	erpnext	Versi 11.0.3 beta32
frappe	erpnext	Versi 11.0.3 beta33
frappe	erpnext	Versi 11.0.3 beta34
frappe	erpnext	Versi 11.0.3 beta35
frappe	erpnext	Versi 11.0.3 beta36
frappe	erpnext	Versi 11.0.3 beta37
frappe	erpnext	Versi 11.0.3 beta4
frappe	erpnext	Versi 11.0.3 beta5
frappe	erpnext	Versi 11.0.3 beta6
frappe	erpnext	Versi 11.0.3 beta7
frappe	erpnext	Versi 11.0.3 beta8
frappe	erpnext	Versi 11.0.3 beta9

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://www.mend.io/vulnerability-database/CVE-2022-23055 exploit · patch · advisory pihak ketiga
https://github.com/frappe/frappe/blob/v13.0.2/frappe/chat/doctype/chat_message/chat_message.py#L134 exploit · advisory pihak ketiga
https://github.com/frappe/frappe/blob/v13.0.2/frappe/chat/doctype/chat_message/chat_message.py#L155 exploit · advisory pihak ketiga

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.