PT-2020-10505 · Frappe · Frappe

Published 2020-03-18 · Updated 2021-07-21 · CVE-2019-20529

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Frappe versions 11 through 12

Description The issue concerns the storage of data files generated with Prepared Report in Frappe. These files were being stored as public files, which means no authentication is required to access them; having a link is sufficient. This is in contrast to the expected behavior of storing them as private files.

Recommendations For Frappe versions 11 through 12, consider modifying the file storage settings in the prepared report.py module to store data files as private files, requiring authentication for access. As a temporary workaround, consider restricting access to the public files generated by Prepared Report until a proper fix is implemented.

Fix

Missing Authentication

Files Accessible to External Parties

Weakness Enumeration

CWE-306

CWE-552

Related Identifiers

CVE-2019-20529

Affected Products

Frappe

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2019-20529 · Security Note
• https://osv.dev/vulnerability/CVE-2019-20529 · Vendor Advisory
• https://github.com/frappe/frappe/pull/8885 · Note
• https://github.com/frappe/frappe/pull/8884 · Note