Incorrect Authorization in Dolibarr
Summary
CVE-2020-12669: Incorrect Authorization in Dolibarr. Affects dolibarr/dolibarr versions < 12.0.0. Fixed in 12.0.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Dolibarr is an open-source ERP and CRM system designed for small and medium-sized businesses. It provides a range of features including accounting, inventory management, project management, and customer relationship management. Dolibarr is widely used by organizations to streamline their business processes and improve efficiency. However, a vulnerability has been discovered in Dolibarr versions before 11.0.4 that allows remote authenticated attackers to bypass intended access restrictions.
Vulnerability Detail
The vulnerability, identified as GHSA-rg8m-84jf-9367, resides in the 'core/get_menudiv.php' file of Dolibarr. It occurs due to incorrect authorization checks in the handling of the 'menu' parameter. By providing a non-alphanumeric value for this parameter, remote attackers with authenticated access can bypass the intended access restrictions imposed by the application. This can lead to unauthorized access to sensitive functionality and data within the Dolibarr system. The vulnerability has been assigned a CVSS score of 8.8, indicating a high severity level.
How To Fix
Minimum fixed version
12.0.0
This is the first release that contains the fix.
composer require dolibarr/dolibarr:12.0.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the official patch or upgrade to the latest version of Dolibarr to resolve the issue.
Conclusion
The vulnerability in Dolibarr before version 11.0.4 allows authenticated attackers to bypass access restrictions, potentially leading to unauthorized access to sensitive functionality and data. To mitigate this risk, it is recommended to upgrade Dolibarr to the latest version or apply the official patch. For further assistance with vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for dolibarr/dolibarr →
FAQ
Dolibarr is an open-source ERP and CRM system used by small and medium-sized businesses for managing various aspects of their operations, including accounting, inventory, and customer relationships.
The vulnerability allows authenticated attackers to bypass access restrictions and gain unauthorized access to sensitive functionality and data within the Dolibarr system.
To fix this vulnerability, you should upgrade Dolibarr to version 11.0.4 or later, which includes a patch for the incorrect authorization issue.
No, there is no known workaround for this vulnerability. It is crucial to apply the official patch or upgrade to the latest version of Dolibarr.
The CVSS score of this vulnerability is 8.8, indicating a high severity level.
Related vulnerabilities
Recent vulnerabilities recorded for dolibarr/dolibarr.
