Frappe HRMS 15.0.0 before 15.64.1 Missing Authorization on File Details Endpoint
概要
Frappe HRMS 15.x before 15.64.1 and 16.x before 16.19.0 contains a missing authorization vulnerability in an endpoint that returns file information, allowing authenticated users to read details of files attached to records they cannot access. Any logged-in user, including one with only the Employee...
影響パッケージ
| パッケージ | 影響を受ける版 → 修正版 | |
|---|---|---|
| frappehrms |
16.0.0 以上 16.19.0 未満→ 16.19.0 |
16.19.0 |
原文の説明 取得元が公開している説明をそのまま載せています (多くは英語)。
Frappe HRMS 15.x before 15.64.1 and 16.x before 16.19.0 contains a missing authorization vulnerability in an endpoint that returns file information, allowing authenticated users to read details of files attached to records they cannot access. Any logged-in user, including one with only the Employee role, can query it to view attachment details on any document type and confirm record existence.
出典: CVE.org (CVE Program・cvelistV5) NVD