ERPNext Multiple Module Business Logic Vulnerabilities Fix Summary

Vulnerability Overview The webpage screenshot presents a summary of vulnerability fixes for the ERPNext system, covering multiple modules. The primary vulnerabilities include: 1. Supplier Retention Issues: - Supplier retention was skipped when issuing credits or journal entries for returns. - Negative bank debits were not recognized as payments. - Refunds from retained suppliers blocked batch journal entries. 2. Procurement Issues: - The RFQ "Received" status was updated only after removing quotation lines, not immediately after updating items. - Different suppliers were retained during the submission of draft scorecards. 3. Inter-company Order Issues: - The second part of internal orders could not be saved. - returned corresponding rows for other columns. - Ordered quantities were not converted to the source Unit of Measure (UOM). 4. Procurement Tracker Issues: - Cost center and project filters were missing for linked subcontracting requests and estimates. - Subcontracting request estimates were split based on service quantities. - Net-zero invoices displayed order amounts incorrectly. 5. Subcontracting and Inventory Issues: - Inventory users were unable to cancel entries with additional inbound order lines. - The sales order form hid the "Create > Subcontracting Inbound Order" action, even when goods were still pending. - Canceling a closed inbound work order released its allocations twice. - Subcontracting receipts returned extra costs again. - When extra costs were net zero, they were not reversed in returns. - Delivery note returns ignored packed components. 6. Project Issues: - Moving subtasks from one group to another failed to reassign them from the old group. - Setting project status failed when tasks were interdependent. - Changing the project of a group task left its subtasks behind. - listed hidden root tasks. - Project update replies collected linked items once per hour. - Time logs associated with empty projects or sales invoices were counted as billed. - Customer portal users could read project time logs. 7. Maintenance and Quality Management Issues: - Monthly maintenance contracts for February could not be saved. - Accessing certain fields completed the title schedule lines of another project. - Edited feedback parameters were not validated against the template. - Edited review objectives were not validated against the objective. 8. Other Issues: - Canceling one part of an inter-company document cleared the source back-link. - Returns with accepted quantities from receipts with rejected quantities were converted to stock adjustments. Impact Scope These vulnerabilities affected multiple modules of the ERPNext system, including supplier management, procurement, inter-company orders, procurement tracking, subcontracting and inventory, project management, and maintenance and quality management. Specific impacts include data inconsistency, functional failures, and security risks. Remediation Each vulnerability has specific remediation steps, such as: 1. Supplier Retention Issues: - Ensure return exemptions apply only to doctypes with the field. - Ensure bank or cash accounts are recognized as payments when credit decreases are greater than zero. - Ensure only net debit supplier rows are checked. 2. Procurement Issues: - Ensure the RFQ "Received" status is updated after removing quotation lines. - Ensure different suppliers are retained when submitting draft scorecards. 3. Inter-company Order Issues: - Ensure the second part of internal orders can be saved. - Ensure returns the correct corresponding rows. - Ensure ordered quantities are converted to the source UOM. 4. Procurement Tracker Issues: - Ensure cost center and project filters do not miss linked subcontracting request estimates. - Ensure subcontracting request estimates are correctly split by service quantities. - Ensure net-zero invoices do not display order amounts. 5. Subcontracting and Inventory Issues: - Ensure inventory users can cancel entries with additional inbound order lines. - Ensure the sales order form correctly hides "Create > Subcontracting Inbound Order" when appropriate. - Ensure canceling a closed inbound work order does not release its allocations twice. - Ensure subcontracting receipts do not return extra costs again. - Ensure extra costs are correctly reversed in returns when net zero. - Ensure delivery note returns correctly ignore packed components. 6. Project Issues: - Ensure moving subtasks from one group reassigns them from the old group. - Ensure setting project status does not fail when tasks are interdependent. - Ensure changing the project of a group task does not leave its subtasks behind. - Ensure does not list hidden root tasks. - Ensure project update replies do not collect links once per hour. - Ensure time logs with empty projects or sales invoices are not counted as billed. - Ensure customer portal users cannot read project time logs. 7. Maintenance and Quality Management Issues: - Ensure monthly main

Goal Reached Thanks to every supporter — we hit 100%!

ERPNext Multiple Module Business Logic Vulnerabilities Fix Summary

More from this source