ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.112.0 and 16.23.0, the ReceivablePayableReport prepare_conditions path in erpnext/accounts/report/accounts_receivable/accounts_receivable.py does not apply Customer and Supplier user permissions to the Payment Ledger Entry dynamic-link party field, allowing any authenticated user to read unauthorized cross-company financial data in Accounts Receivable and Accounts Payable reports. This issue is fixed in versions 15.112.0 and 16.23.0.
Attack Parameters
Attack Vector
Network
Can be exploited remotely
Attack Complexity
Low
Easy to exploit
Attack Requirements
None
No additional conditions
Privileges Required
Low
Basic privileges needed
User Interaction
None
No user interaction needed
Impact Assessment
Confidentiality
High
Complete data leak
Integrity
None
No data modification
Availability
None
No disruption
CVSS Vector v4.0
Weakness Type (CWE)
Vulnerable Products
frappe:erpnext
References 6
https://github.com/frappe/erpnext/security/advisories/GHSA-p577-cxv9-h82f
https://github.com/frappe/erpnext/security/advisories/GHSA-p577-cxv9-h82f
https://github.com/frappe/erpnext/pull/55696
https://github.com/frappe/erpnext/pull/55696
https://github.com/frappe/erpnext/commit/b05abbc53b3655b02db17ba2e8165519f195c1…
https://github.com/frappe/erpnext/commit/b05abbc53b3655b02db17ba2e8165519f195c1c2
https://github.com/frappe/erpnext/commit/c03a66a1bf48a53c42d01c9d936d9b22aa013e…
https://github.com/frappe/erpnext/commit/c03a66a1bf48a53c42d01c9d936d9b22aa013e11
https://github.com/frappe/erpnext/releases/tag/v15.112.0
https://github.com/frappe/erpnext/releases/tag/v15.112.0
https://github.com/frappe/erpnext/releases/tag/v16.23.0
https://github.com/frappe/erpnext/releases/tag/v16.23.0