CVE:CVE-2022-23055
CNNVD:CNNVD-202206-2194
ERPNext是印度ERPNext公司的一套开源的企业资源计划解决方案。
ERPNext  v11.0.0-beta 到 v13.0.2版本存在安全漏洞，该漏洞源于在聊天室功能中容易受到缺少授权的影响，攻击者利用该漏洞可以向任何成员或组发送直接消息或组消息，冒充自己为管理员，还可以读取他们不属于的组和其他用户的聊天消息。
solution:Upgrade frappe erpnext to a higher version than 13.1.0,11.0.3:beta1,11.0.3:beta10,11.0.3:beta11,11.0.3:beta12,11.0.3:beta13,11.0.3:beta14,11.0.3:beta15,11.0.3:beta16,11.0.3:beta17,11.0.3:beta18,11.0.3:beta19,11.0.3:beta2,11.0.3:beta20,11.0.3:beta21,11.0.3:beta22,11.0.3:beta23,11.0.3:beta24,11.0.3:beta25,11.0.3:beta26,11.0.3:beta27,11.0.3:beta28,11.0.3:beta29,11.0.3:beta3,11.0.3:beta30,11.0.3:beta31,11.0.3:beta32,11.0.3:beta33,11.0.3:beta34,11.0.3:beta35,11.0.3:beta36,11.0.3:beta37,11.0.3:beta4,11.0.3:beta5,11.0.3:beta6,11.0.3:beta7,11.0.3:beta8,11.0.3:beta9,and avoid the version [11.0.4,13.1.0),11.0.3:beta1,11.0.3:beta10,11.0.3:beta11,11.0.3:beta12,11.0.3:beta13,11.0.3:beta14,11.0.3:beta15,11.0.3:beta16,11.0.3:beta17,11.0.3:beta18,11.0.3:beta19,11.0.3:beta2,11.0.3:beta20,11.0.3:beta21,11.0.3:beta22,11.0.3:beta23,11.0.3:beta24,11.0.3:beta25,11.0.3:beta26,11.0.3:beta27,11.0.3:beta28,11.0.3:beta29,11.0.3:beta3,11.0.3:beta30,11.0.3:beta31,11.0.3:beta32,11.0.3:beta33,11.0.3:beta34,11.0.3:beta35,11.0.3:beta36,11.0.3:beta37,11.0.3:beta4,11.0.3:beta5,11.0.3:beta6,11.0.3:beta7,11.0.3:beta8,11.0.3:beta9