Lucene search

[email protected]CVE-2023-4198

HistoryNov 01, 2023 - 9:15 a.m.

CVE-2023-4198

2023-11-0109:15:09

CWE-862

[email protected]

web.nvd.nist.gov

cve-2023-4198

improper access control

dolibarr erp crm

vulnerability

nvd

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

7 High

AI Score

Confidence

Low

4 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:N/A:N

0.0005 Low

EPSS

Percentile

17.1%

JSON

Improper Access Control in Dolibarr ERP CRM <= v17.0.3 allows an unauthorized authenticated user to read a database table containing customer data

CPENameOperatorVersion
dolibarr:dolibarr_erp\/crmdolibarr dolibarr erp\/crmle17.0.3
dolibarr:dolibarr_erp\/crmdolibarr dolibarr erp\/crmeq16.0.5
dolibarr:dolibarr_erp\/crmdolibarr dolibarr erp\/crmeq12.0.3
dolibarr:dolibarr_erp\/crmdolibarr dolibarr erp\/crmeq3.6.0
dolibarr:dolibarr_erp\/crmdolibarr dolibarr erp\/crmeq3.6.2
dolibarr:dolibarr_erp\/crmdolibarr dolibarr erp\/crmeq3.9.0
dolibarr:dolibarr_erp\/crmdolibarr dolibarr erp\/crmeq3.5.7
dolibarr:dolibarr_erp\/crmdolibarr dolibarr erp\/crmeq3.3.0
dolibarr:dolibarr_erp\/crmdolibarr dolibarr erp\/crmeq4.0.3
dolibarr:dolibarr_erp\/crmdolibarr dolibarr erp\/crmeq3.8.3

CPE	Name	Operator	Version
dolibarr:dolibarr_erp\/crm	dolibarr dolibarr erp\/crm	le	17.0.3
dolibarr:dolibarr_erp\/crm	dolibarr dolibarr erp\/crm	eq	16.0.5
dolibarr:dolibarr_erp\/crm	dolibarr dolibarr erp\/crm	eq	12.0.3
dolibarr:dolibarr_erp\/crm	dolibarr dolibarr erp\/crm	eq	3.6.0
dolibarr:dolibarr_erp\/crm	dolibarr dolibarr erp\/crm	eq	3.6.2
dolibarr:dolibarr_erp\/crm	dolibarr dolibarr erp\/crm	eq	3.9.0
dolibarr:dolibarr_erp\/crm	dolibarr dolibarr erp\/crm	eq	3.5.7
dolibarr:dolibarr_erp\/crm	dolibarr dolibarr erp\/crm	eq	3.3.0
dolibarr:dolibarr_erp\/crm	dolibarr dolibarr erp\/crm	eq	4.0.3
dolibarr:dolibarr_erp\/crm	dolibarr dolibarr erp\/crm	eq	3.8.3

Rows per page:

1-10 of 1441

References

github.com/Dolibarr/dolibarr/commit/3065b9ca6ade988e8d7a8a8550415c0abb56b9cb#diff-7d68365a708c954051853ade884c7e97c6ff13150ee92657d6ffc8603e0f947b

starlabs.sg/advisories/23/23-4198

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

7 High

AI Score

Confidence

Low

4 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:N/A:N

0.0005 Low

EPSS

Percentile

17.1%

JSON

Related for CVE-2023-4198

osv2 veracode1 cvelist1 prion1 ubuntucve1 github1