CVE-2022-23055

Estado: ModificadaMedia (5.5)—
In ERPNext, versions v11.0.0-beta through v13.0.2 are vulnerable to Missing Authorization, in the chat rooms functionality. A low privileged attacker can send a direct message or a group message to any member or group, impersonating themselves as the administrator. The attacker can also read chat messages of groups that they do not belong to, and of other users.
CVSS

Versión: 2.0
Vector: AV:N/AC:L/Au:S/C:P/I:P/A:N
Puntuación base: 5.5
Probabilidad de explotación (EPSS)

Probabilidad de explotación en los próximos 30 días: 1.20%
Percentil entre todas las CVEs puntuadas: 67
Fecha de la puntuación: 7/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
Tecnologías afectadas (1)

Frappe — Erpnext
CWE

CWE-862
Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2022-23055",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 5.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:N",
          "authentication": "SINGLE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 4.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "vulnerabilitylab@mend.io",
      "affectedData": [
        {
          "vendor": "frappe",
          "product": "frappe",
          "versions": [
            {
              "status": "affected",
              "version": "v11.0.3-beta.1",
              "lessThan": "unspecified",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom",
              "lessThanOrEqual": "v13.14.1"
            }
          ]
        }
      ]
    }
  ],
  "published": "2022-06-22T09:15:08.007",
  "references": [
    {
      "url": "https://github.com/frappe/frappe/blob/v13.0.2/frappe/chat/doctype/chat_message/chat_message.py#L134",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "source": "vulnerabilitylab@mend.io"
    },
    {
      "url": "https://github.com/frappe/frappe/blob/v13.0.2/frappe/chat/doctype/chat_message/chat_message.py#L155",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "source": "vulnerabilitylab@mend.io"
    },
    {
      "url": "https://www.mend.io/vulnerability-database/CVE-2022-23055",
      "tags": [
        "Exploit",
        "Patch",
        "Third Party Advisory"
      ],
      "source": "vulnerabilitylab@mend.io"
    },
    {
      "url": "https://github.com/frappe/frappe/blob/v13.0.2/frappe/chat/doctype/chat_message/chat_message.py#L134",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://github.com/frappe/frappe/blob/v13.0.2/frappe/chat/doctype/chat_message/chat_message.py#L155",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.mend.io/vulnerability-database/CVE-2022-23055",
      "tags": [
        "Exploit",
        "Patch",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "vulnerabilitylab@mend.io",
      "description": [
        {
          "lang": "en",
          "value": "CWE-862"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "In ERPNext, versions v11.0.0-beta through v13.0.2 are vulnerable to Missing Authorization, in the chat rooms functionality. A low privileged attacker can send a direct message or a group message to any member or group, impersonating themselves as the administrator. The attacker can also read chat messages of groups that they do not belong to, and of other users."
    },
    {
      "lang": "es",
      "value": "En ERPNext, versiones v11.0.0-beta hasta v13.0.2, son vulnerables a una falta de autorización, en la funcionalidad chat rooms. Un atacante poco privilegiado puede enviar un mensaje directo o un mensaje de grupo a cualquier miembro o grupo, haciéndose pasar por el administrador. El atacante también puede leer los mensajes de chat de grupos a los que no pertenece, y de otros usuarios"
    }
  ],
  "lastModified": "2026-06-17T04:29:25.790",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:frappe:erpnext:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BBF3D7E6-2B29-4142-A007-F699140D1C9A",
              "versionEndExcluding": "13.1.0",
              "versionStartIncluding": "11.0.4"
            },
            {
              "criteria": "cpe:2.3:a:frappe:erpnext:11.0.3:beta1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B76E3184-E14E-485B-A108-C1F24850F77E"
            },
            {
              "criteria": "cpe:2.3:a:frappe:erpnext:11.0.3:beta10:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C9DCB37E-061E-44D6-A686-6464B5BE54D2"
            },
            {
              "criteria": "cpe:2.3:a:frappe:erpnext:11.0.3:beta11:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "93C2D6DF-B4E5-434B-8632-DB1DF10CE5E9"
            },
            {
              "criteria": "cpe:2.3:a:frappe:erpnext:11.0.3:beta12:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0C6F3220-13B5-4504-87DB-09495E5E1386"
            },
            {
              "criteria": "cpe:2.3:a:frappe:erpnext:11.0.3:beta13:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D6AFF494-240F-4981-B4EC-24771A6E1E4C"
            },
            {
              "criteria": "cpe:2.3:a:frappe:erpnext:11.0.3:beta14:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "69D3FEA8-FC3F-434E-AFA6-D03D8EFAC524"
            },
            {
              "criteria": "cpe:2.3:a:frappe:erpnext:11.0.3:beta15:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D9D81630-3EE2-498E-9A76-0F0C1CDD1A15"
            },
            {
              "criteria": "cpe:2.3:a:frappe:erpnext:11.0.3:beta16:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C3367D0E-5701-4FCA-8307-0FA7D25D71E3"
            },
            {
              "criteria": "cpe:2.3:a:frappe:erpnext:11.0.3:beta17:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1DBD878F-935B-427F-B6DF-4DA4356E9843"
            },
            {
              "criteria": "cpe:2.3:a:frappe:erpnext:11.0.3:beta18:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "DAE5DFE4-55B8-4F68-8C3A-2CDC13D8A735"
            },
            {
              "criteria": "cpe:2.3:a:frappe:erpnext:11.0.3:beta19:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6F22BFC9-CA3D-4B57-AD93-1B5094D69508"
            },
            {
              "criteria": "cpe:2.3:a:frappe:erpnext:11.0.3:beta2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "FE5E71D9-CCD4-47F4-9AC8-4E4A112E9C0A"
            },
            {
              "criteria": "cpe:2.3:a:frappe:erpnext:11.0.3:beta20:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "CA394555-C3A0-4142-B023-60A9014C87E8"
            },
            {
              "criteria": "cpe:2.3:a:frappe:erpnext:11.0.3:beta21:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6B5C737A-A824-4E7D-A8D6-A0E0A4AE710A"
            },
            {
              "criteria": "cpe:2.3:a:frappe:erpnext:11.0.3:beta22:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "33E4D6A6-2F64-4DB8-9946-5E54FE889E6C"
            },
            {
              "criteria": "cpe:2.3:a:frappe:erpnext:11.0.3:beta23:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8AAD166B-0B54-4D74-A61D-A17F34C403F6"
            },
            {
              "criteria": "cpe:2.3:a:frappe:erpnext:11.0.3:beta24:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2856944B-7178-414D-B485-5B8C4D88E95D"
            },
            {
              "criteria": "cpe:2.3:a:frappe:erpnext:11.0.3:beta25:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "27EE33DF-6485-463D-BB51-33D4295D3E55"
            },
            {
              "criteria": "cpe:2.3:a:frappe:erpnext:11.0.3:beta26:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "FBEED6D7-3EA2-4BC0-B7F8-5F104F90EB82"
            },
            {
              "criteria": "cpe:2.3:a:frappe:erpnext:11.0.3:beta27:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C5E9A6A8-A210-467F-888C-1327C8E5F5D0"
            },
            {
              "criteria": "cpe:2.3:a:frappe:erpnext:11.0.3:beta28:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "97CA5919-E7B0-417B-BF91-6B407F83F167"
            },
            {
              "criteria": "cpe:2.3:a:frappe:erpnext:11.0.3:beta29:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E0C2C925-F3D3-4C5D-A281-2BE62F32BB52"
            },
            {
              "criteria": "cpe:2.3:a:frappe:erpnext:11.0.3:beta3:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0411AA32-05B2-49C2-A0DC-8F74BDABCA3B"
            },
            {
              "criteria": "cpe:2.3:a:frappe:erpnext:11.0.3:beta30:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "31D7C223-4E62-41E1-A88F-54DF1DFA9C75"
            },
            {
              "criteria": "cpe:2.3:a:frappe:erpnext:11.0.3:beta31:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C1686CCA-6C44-425C-B851-D429A5C550CF"
            },
            {
              "criteria": "cpe:2.3:a:frappe:erpnext:11.0.3:beta32:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "873CA32C-42A6-4531-838A-E4B584AB389D"
            },
            {
              "criteria": "cpe:2.3:a:frappe:erpnext:11.0.3:beta33:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "17B6D20B-863A-48C0-8600-BE768498DBFF"
            },
            {
              "criteria": "cpe:2.3:a:frappe:erpnext:11.0.3:beta34:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6CA04572-0978-4378-A658-15896AFDEBFC"
            },
            {
              "criteria": "cpe:2.3:a:frappe:erpnext:11.0.3:beta35:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8697CA97-1F21-4158-9773-BB67A250BDD7"
            },
            {
              "criteria": "cpe:2.3:a:frappe:erpnext:11.0.3:beta36:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E7746744-C5D1-459E-9574-ADC2FD24CED8"
            },
            {
              "criteria": "cpe:2.3:a:frappe:erpnext:11.0.3:beta37:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1F61D01B-BB6D-4A4E-9774-BEC19997A733"
            },
            {
              "criteria": "cpe:2.3:a:frappe:erpnext:11.0.3:beta4:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "EE9DFDFA-9387-46C2-BC9C-58A90713F0E6"
            },
            {
              "criteria": "cpe:2.3:a:frappe:erpnext:11.0.3:beta5:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "86661EEC-799A-404B-A847-D91A00403F3C"
            },
            {
              "criteria": "cpe:2.3:a:frappe:erpnext:11.0.3:beta6:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2AFA67C7-6829-4160-A7C8-B3DD56E60CF3"
            },
            {
              "criteria": "cpe:2.3:a:frappe:erpnext:11.0.3:beta7:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "90E1D4DA-2D89-4CD5-B34F-33D96BD2C341"
            },
            {
              "criteria": "cpe:2.3:a:frappe:erpnext:11.0.3:beta8:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8B4BE801-0FF0-4B44-8DCF-E2805DCC39A6"
            },
            {
              "criteria": "cpe:2.3:a:frappe:erpnext:11.0.3:beta9:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B4AE27CF-FCAF-4491-AAC1-8EB5E5C5FD6A"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "vulnerabilitylab@mend.io"
}