CVE-2022-43138: Dolibarr Open Source ERP & CRM Privilege Escalation
Summary
CVE-2022-43138: Dolibarr vulnerable to privilege escalation. Affects dolibarr/dolibarr versions < 14.0.1. Fixed in 14.0.1. How to fix ↓
Also tracked for
- dolibarr · Bitnami
The same CVE-2022-43138 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Dolibarr is an open-source ERP & CRM solution designed for business management. It provides a comprehensive set of features for managing various aspects of a company, including sales, inventory, accounting, and more. Dolibarr is widely used by organizations to streamline their operations and improve efficiency. However, a vulnerability has been discovered in Dolibarr versions prior to v14.0.1 that allows attackers to escalate privileges through a crafted API request.
Vulnerability Detail
The vulnerability in Dolibarr allows attackers to escalate their privileges by exploiting a flaw in the API. By sending a specially crafted API request, an attacker can bypass the existing access controls and gain elevated privileges within the system. This can lead to unauthorized access to sensitive data, modification of critical settings, and potential disruption of business operations. The vulnerability has been assigned a CVSS score of 9.8, indicating its critical severity.
How To Fix
Minimum fixed version
14.0.1
This is the first release that contains the fix.
composer require dolibarr/dolibarr:14.0.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the official patch by upgrading to Dolibarr version 14.0.1 or later.
Conclusion
Dolibarr Open Source ERP & CRM versions prior to v14.0.1 are vulnerable to privilege escalation. Attackers can exploit this vulnerability to gain elevated privileges within the system, potentially leading to unauthorized access and data manipulation. It is crucial for users to upgrade to Dolibarr version 14.0.1 or later to mitigate the risk. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for dolibarr/dolibarr →
FAQ
Dolibarr is an open-source ERP & CRM solution used for business management.
The vulnerability allows attackers to escalate their privileges and gain unauthorized access to sensitive data or modify critical settings.
To fix this vulnerability, upgrade Dolibarr to version 14.0.1 or later.
No, there is no known workaround. Upgrading to the patched version is the recommended solution.
The CVSS score of this vulnerability is 9.8, indicating its critical severity.
Related vulnerabilities
Recent vulnerabilities recorded for dolibarr/dolibarr.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
