high7.5
CVE-2019-20529
In core/doctype/prepared_report/prepared_report.py in Frappe 11 and 12, data files generated with Prepared Report were being stored as public files (no authent…
Impact
In core/doctype/prepared_report/prepared_report.py in Frappe 11 and 12, data files generated with Prepared Report were being stored as public files (no authentication is required to access; having a link is sufficient) instead of private files.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Frappe | Frappe | Versions 11.0.0, 12.0.0 |