CVE-2020-7995: Dolibarr 10.0.6 Unlimited Failed Authentication Attempts Vulnerability
Summary
CVE-2020-7995: The htdocs/index.php?mainmenu=home login page in Dolibarr 10.0.6 allows an unlimited rate of failed authentication attempts. Affects dolibarr versions >= 10.0.6, <= 10.0.6. No fix is published. How to fix ↓
Also tracked for
- dolibarr/dolibarr · Packagist
The same CVE-2020-7995 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Dolibarr is an open-source ERP and CRM solution designed for small and medium-sized businesses. It provides a comprehensive suite of tools for managing various business processes, including invoicing, project management, and customer relationship management. The platform is modular, allowing users to customize their experience based on specific business needs. However, Dolibarr 10.0.6 is susceptible to a critical vulnerability that allows unlimited failed authentication attempts, potentially leading to unauthorized access.
Vulnerability Detail
The vulnerability exists in the login page of Dolibarr, specifically at htdocs/index.php?mainmenu=home. It allows attackers to perform an unlimited number of failed authentication attempts without any lockout mechanism. This flaw can be exploited to conduct brute-force attacks, where an attacker systematically tries various username and password combinations to gain unauthorized access to the system. The lack of rate limiting on authentication attempts poses a significant security risk, as it can lead to account compromise and data breaches.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, administrators can implement IP-based rate limiting or use a web application firewall (WAF) to restrict the number of login attempts from a single IP address. This can help mitigate the risk of brute-force attacks until a patch is applied.
Conclusion
CVE-2020-7995 represents a critical security vulnerability in Dolibarr 10.0.6 that allows unlimited failed authentication attempts. It is crucial for users to update their installations to the latest version to protect against potential brute-force attacks and unauthorized access. Implementing temporary workarounds can help mitigate risks until a permanent fix is applied.
See every vulnerability recorded for dolibarr →
FAQ
CVE-2020-7995 is a vulnerability in Dolibarr 10.0.6 that allows unlimited failed authentication attempts, increasing the risk of brute-force attacks.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The vulnerability can lead to unauthorized access to user accounts, data breaches, and potential compromise of sensitive business information.
Yes, users are advised to update to the latest version of Dolibarr that includes a fix for this vulnerability.
Implement IP-based rate limiting or use a web application firewall (WAF) to mitigate the risk of brute-force attacks until you can apply the patch.
Related vulnerabilities
Recent vulnerabilities recorded for dolibarr.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
