CVE-2017-17898: Dolibarr sensitive information disclosure
Summary
CVE-2017-17898: Dolibarr sensitive information disclosure. Affects dolibarr/dolibarr versions < 6.0.5. Fixed in 6.0.5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Dolibarr ERP/CRM is an open-source software package that provides enterprise resource planning (ERP) and customer relationship management (CRM) functionalities. It is widely used for managing various business processes, including sales, inventory, invoicing, and more. Dolibarr version 6.0.4 is affected by a vulnerability that allows remote attackers to obtain sensitive information. This vulnerability arises from the lack of blocking direct requests to *.tpl.php files.
Vulnerability Detail
The vulnerability in Dolibarr version 6.0.4 enables attackers to access sensitive information by directly requesting *.tpl.php files. This can lead to the exposure of confidential data, such as user credentials, financial records, or other sensitive information stored within the application. The lack of proper access controls allows unauthorized individuals to exploit this vulnerability and potentially cause significant harm to the affected system.
How To Fix
Minimum fixed version
6.0.5
This is the first release that contains the fix.
composer require dolibarr/dolibarr:6.0.5Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can manually block direct requests to *.tpl.php files by configuring their web server or application firewall. This can be achieved by adding specific rules or filters to restrict access to these files. However, applying the official fix by upgrading to the latest version is the recommended approach for long-term security.
Conclusion
The vulnerability in Dolibarr version 6.0.4 allows remote attackers to obtain sensitive information by directly requesting *.tpl.php files. To mitigate this risk, it is crucial to upgrade to Dolibarr version 6.0.5 or later, which includes the necessary security patches. Additionally, users can apply a temporary workaround by blocking direct requests to *.tpl.php files. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for dolibarr/dolibarr →
FAQ
Dolibarr ERP/CRM is an open-source software package that provides enterprise resource planning (ERP) and customer relationship management (CRM) functionalities. It is widely used for managing various business processes, including sales, inventory, invoicing, and more.
The vulnerability allows remote attackers to obtain sensitive information stored within the Dolibarr application. This can include user credentials, financial records, or other confidential data. Exploiting this vulnerability can lead to unauthorized access, data breaches, and potential harm to the affected system.
To fix this vulnerability, it is recommended to upgrade Dolibarr to version 6.0.5 or later. The updated version includes security patches that address the issue and prevent unauthorized access to sensitive information.
As a temporary workaround, users can manually block direct requests to *.tpl.php files by configuring their web server or application firewall. However, applying the official fix by upgrading to the latest version is the recommended approach for long-term security.
You can use Vulert's playground (https://vulert.com/scanner) to check if your Dolibarr installation is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, allowing you to assess the security of your software without requiring access to the code or installation.
References
Related vulnerabilities
Recent vulnerabilities recorded for dolibarr/dolibarr.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
