CVE-2020-7995: Dolibarr Improper Restriction of Excessive Authentication Attempts
Summary
CVE-2020-7995: Dolibarr Improper Restriction of Excessive Authentication Attempts. Affects dolibarr/dolibarr versions 10.0.6. No fix is published. How to fix ↓
Also tracked for
- dolibarr · Bitnami
The same CVE-2020-7995 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Dolibarr is an open-source ERP and CRM software package that provides a range of features for managing business processes. It is widely used by organizations to streamline their operations, including inventory management, invoicing, project management, and more. Dolibarr is written in PHP and is available on Packagist. This vulnerability affects Dolibarr version 10.0.6.
Vulnerability Detail
The htdocs/index.php?mainmenu=home login page in Dolibarr 10.0.6 allows an unlimited rate of failed authentication attempts. This means that an attacker can repeatedly attempt to guess a user's password without any restrictions, potentially leading to unauthorized access to the system. The lack of rate limiting or account lockout mechanism makes it easier for an attacker to perform brute-force attacks and gain unauthorized access to sensitive information or perform malicious actions within the system.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, administrators can implement IP-based rate limiting or use a web application firewall (WAF) to block suspicious IP addresses that exhibit excessive failed login attempts. However, this workaround may not provide complete protection and should be considered a temporary solution until the vulnerability is properly fixed.
Conclusion
The Dolibarr version 10.0.6 is vulnerable to an improper restriction of excessive authentication attempts. This can lead to unauthorized access to the system and potential misuse of sensitive information. It is crucial for administrators to implement proper rate limiting and strong password policies to mitigate the risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for dolibarr/dolibarr →
FAQ
Dolibarr is an open-source ERP and CRM software package that helps organizations manage their business processes.
This vulnerability affects Dolibarr version 10.0.6.
The lack of rate limiting on the login page allows an attacker to perform brute-force attacks and potentially gain unauthorized access to the system.
To fix this vulnerability, it is recommended to implement a rate limiting mechanism on the login page and enforce strong password policies.
As a temporary workaround, administrators can implement IP-based rate limiting or use a web application firewall (WAF) to block suspicious IP addresses.
Related vulnerabilities
Recent vulnerabilities recorded for dolibarr/dolibarr.
