CVE-2020-35136: Dolibarr authenticated Remote Code Execution
Summary
CVE-2020-35136: Dolibarr authenticated Remote Code Execution. Affects dolibarr/dolibarr versions < 12.0.4. Fixed in 12.0.4. How to fix ↓
Also tracked for
- dolibarr · Bitnami
The same CVE-2020-35136 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Dolibarr is an open-source ERP and CRM software package that provides various functionalities for managing business processes. It is widely used for its flexibility, ease of use, and extensive features. However, Dolibarr versions up to 12.0.3 are vulnerable to an authenticated Remote Code Execution (RCE) attack.
Vulnerability Detail
The vulnerability in Dolibarr allows an attacker with access to the admin dashboard to exploit the backup function. By manipulating the zipfilename_template parameter in the admin/tools/dolibarr_export.php file, an attacker can inject a payload into the filename. This can lead to the execution of arbitrary code on the server, potentially compromising the entire system. The severity of this vulnerability is rated as HIGH with a CVSS score of 7.2.
How To Fix
Minimum fixed version
12.0.4
This is the first release that contains the fix.
composer require dolibarr/dolibarr:12.0.4Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to apply the official patch by upgrading to the latest version of Dolibarr.
Conclusion
Dolibarr versions up to 12.0.3 are vulnerable to an authenticated Remote Code Execution (RCE) attack. It is crucial for users to upgrade to version 12.0.4 or later to mitigate this vulnerability. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for dolibarr/dolibarr →
FAQ
Dolibarr is an open-source ERP and CRM software package that helps businesses manage their processes efficiently.
The vulnerability allows an attacker to execute arbitrary code on the server, potentially leading to a complete compromise of the system.
To fix this vulnerability, you need to upgrade Dolibarr to version 12.0.4 or later.
No, there is no known workaround. It is essential to apply the official patch by upgrading to the latest version of Dolibarr.
The severity of this vulnerability is rated as HIGH with a CVSS score of 7.2.
Related vulnerabilities
Recent vulnerabilities recorded for dolibarr/dolibarr.
