CVE-2018-20061
- Source
- https://cve.org/CVERecord?id=CVE-2018-20061
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2018-20061.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2018-20061
- Published
- 2018-12-11T17:29:00.507Z
- Modified
- 2026-07-08T05:57:40.966915961Z
- Severity
-
- 7.5 (High) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
- Summary
- [none]
- Details
-
A SQL injection issue was discovered in ERPNext 10.x and 11.x through 11.0.3-beta.29. This attack is only available to a logged-in user; however, many ERPNext sites allow account creation via the web. No special privileges are needed to conduct the attack. By calling a JavaScript function that calls a server-side Python function with carefully chosen arguments, a SQL attack can be carried out which allows SQL queries to be constructed to return any columns from any tables in the database. This is related to /api/resource/Item?fields= URIs, frappe.get_list, and frappe.call.
- Database specific
{ "unresolved_ranges": [ { "source": "CPE_STRING", "cpes": [ "cpe:2.3:a:frappe:erpnext:11.0.3:beta10:*:*:*:*:*:*", "cpe:2.3:a:frappe:erpnext:11.0.3:beta11:*:*:*:*:*:*", "cpe:2.3:a:frappe:erpnext:11.0.3:beta12:*:*:*:*:*:*", "cpe:2.3:a:frappe:erpnext:11.0.3:beta13:*:*:*:*:*:*", "cpe:2.3:a:frappe:erpnext:11.0.3:beta14:*:*:*:*:*:*", "cpe:2.3:a:frappe:erpnext:11.0.3:beta15:*:*:*:*:*:*", "cpe:2.3:a:frappe:erpnext:11.0.3:beta16:*:*:*:*:*:*", "cpe:2.3:a:frappe:erpnext:11.0.3:beta17:*:*:*:*:*:*", "cpe:2.3:a:frappe:erpnext:11.0.3:beta18:*:*:*:*:*:*", "cpe:2.3:a:frappe:erpnext:11.0.3:beta19:*:*:*:*:*:*", "cpe:2.3:a:frappe:erpnext:11.0.3:beta20:*:*:*:*:*:*", "cpe:2.3:a:frappe:erpnext:11.0.3:beta21:*:*:*:*:*:*", "cpe:2.3:a:frappe:erpnext:11.0.3:beta22:*:*:*:*:*:*", "cpe:2.3:a:frappe:erpnext:11.0.3:beta23:*:*:*:*:*:*", "cpe:2.3:a:frappe:erpnext:11.0.3:beta24:*:*:*:*:*:*", "cpe:2.3:a:frappe:erpnext:11.0.3:beta25:*:*:*:*:*:*", "cpe:2.3:a:frappe:erpnext:11.0.3:beta26:*:*:*:*:*:*", "cpe:2.3:a:frappe:erpnext:11.0.3:beta27:*:*:*:*:*:*", "cpe:2.3:a:frappe:erpnext:11.0.3:beta28:*:*:*:*:*:*", "cpe:2.3:a:frappe:erpnext:11.0.3:beta29:*:*:*:*:*:*", "cpe:2.3:a:frappe:erpnext:11.0.3:beta2:*:*:*:*:*:*", "cpe:2.3:a:frappe:erpnext:11.0.3:beta3:*:*:*:*:*:*", "cpe:2.3:a:frappe:erpnext:11.0.3:beta4:*:*:*:*:*:*", "cpe:2.3:a:frappe:erpnext:11.0.3:beta5:*:*:*:*:*:*", "cpe:2.3:a:frappe:erpnext:11.0.3:beta6:*:*:*:*:*:*", "cpe:2.3:a:frappe:erpnext:11.0.3:beta7:*:*:*:*:*:*", "cpe:2.3:a:frappe:erpnext:11.0.3:beta8:*:*:*:*:*:*", "cpe:2.3:a:frappe:erpnext:11.0.3:beta9:*:*:*:*:*:*" ], "vendor_product": "frappe:erpnext", "extracted_events": [ { "introduced": "11.0.3-beta10" }, { "last_affected": "11.0.3-beta10" }, { "introduced": "11.0.3-beta11" }, { "last_affected": "11.0.3-beta11" }, { "introduced": "11.0.3-beta12" }, { "last_affected": "11.0.3-beta12" }, { "introduced": "11.0.3-beta13" }, { "last_affected": "11.0.3-beta13" }, { "introduced": "11.0.3-beta14" }, { "last_affected": "11.0.3-beta14" }, { "introduced": "11.0.3-beta15" }, { "last_affected": "11.0.3-beta15" }, { "introduced": "11.0.3-beta16" }, { "last_affected": "11.0.3-beta16" }, { "introduced": "11.0.3-beta17" }, { "last_affected": "11.0.3-beta17" }, { "introduced": "11.0.3-beta18" }, { "last_affected": "11.0.3-beta18" }, { "introduced": "11.0.3-beta19" }, { "last_affected": "11.0.3-beta19" }, { "introduced": "11.0.3-beta2" }, { "last_affected": "11.0.3-beta2" }, { "introduced": "11.0.3-beta20" }, { "last_affected": "11.0.3-beta20" }, { "introduced": "11.0.3-beta21" }, { "last_affected": "11.0.3-beta21" }, { "introduced": "11.0.3-beta22" }, { "last_affected": "11.0.3-beta22" }, { "introduced": "11.0.3-beta23" }, { "last_affected": "11.0.3-beta23" }, { "introduced": "11.0.3-beta24" }, { "last_affected": "11.0.3-beta24" }, { "introduced": "11.0.3-beta25" }, { "last_affected": "11.0.3-beta25" }, { "introduced": "11.0.3-beta26" }, { "last_affected": "11.0.3-beta26" }, { "introduced": "11.0.3-beta27" }, { "last_affected": "11.0.3-beta27" }, { "introduced": "11.0.3-beta28" }, { "last_affected": "11.0.3-beta28" }, { "introduced": "11.0.3-beta29" }, { "last_affected": "11.0.3-beta29" }, { "introduced": "11.0.3-beta3" }, { "last_affected": "11.0.3-beta3" }, { "introduced": "11.0.3-beta4" }, { "last_affected": "11.0.3-beta4" }, { "introduced": "11.0.3-beta5" }, { "last_affected": "11.0.3-beta5" }, { "introduced": "11.0.3-beta6" }, { "last_affected": "11.0.3-beta6" }, { "introduced": "11.0.3-beta7" }, { "last_affected": "11.0.3-beta7" }, { "introduced": "11.0.3-beta8" }, { "last_affected": "11.0.3-beta8" }, { "introduced": "11.0.3-beta9" }, { "last_affected": "11.0.3-beta9" } ] } ] }- References
Affected packages
Git / github.com/frappe/erpnext
Affected ranges
- Type
- GIT
- Repo
- https://github.com/frappe/erpnext
- Events
-
IntroducedLast affectedIntroduced0 Unknown introduced commit / All previous commits are affectedFixed
- Database specific
{ "cpe": "cpe:2.3:a:frappe:erpnext:*:*:*:*:*:*:*:*", "extracted_events": [ { "introduced": "10.0.0" }, { "last_affected": "10.1.76" }, { "introduced": "11.0.0" }, { "fixed": "11.0.3" } ], "source": "CPE_RANGE" }
Affected versions
v10.*
v10.0.0
v10.0.1
v10.0.10
v10.0.11
v10.0.12
v10.0.13
v10.0.14
v10.0.15
v10.0.16
v10.0.17
v10.0.18
v10.0.19
v10.0.2
v10.0.20
v10.0.21
v10.0.22
v10.0.23
v10.0.3
v10.0.4
v10.0.5
v10.0.6
v10.0.7
v10.0.8
v10.0.9
v10.1.0
v10.1.1
v10.1.10
v10.1.11
v10.1.12
v10.1.13
v10.1.14
v10.1.15
v10.1.16
v10.1.17
v10.1.18
v10.1.19
v10.1.2
v10.1.20
v10.1.21
v10.1.22
v10.1.23
v10.1.24
v10.1.25
v10.1.26
v10.1.27
v10.1.28
v10.1.29
v10.1.3
v10.1.30
v10.1.31
v10.1.32
v10.1.33
v10.1.34
v10.1.35
v10.1.36
v10.1.37
v10.1.38
v10.1.39
v10.1.4
v10.1.40
v10.1.41
v10.1.42
v10.1.43
v10.1.44
v10.1.45
v10.1.46
v10.1.47
v10.1.48
v10.1.49
v10.1.5
v10.1.50
v10.1.51
v10.1.52
v10.1.53
v10.1.54
v10.1.55
v10.1.56
v10.1.57
v10.1.58
v10.1.59
v10.1.6
v10.1.60
v10.1.61
v10.1.62
v10.1.63
v10.1.64
v10.1.65
v10.1.66
v10.1.67
v10.1.68
v10.1.69
v10.1.7
v10.1.70
v10.1.71
v10.1.72
v10.1.73
v10.1.74
v10.1.75
v10.1.76
v10.1.8
v10.1.9
v11.*
v11.0.0-beta
v11.0.1
v11.0.2