Lucene search

K
cve[email protected]CVE-2024-5315
HistoryMay 24, 2024 - 10:15 a.m.

CVE-2024-5315

2024-05-2410:15:11
CWE-89
web.nvd.nist.gov
28
dolibarr erp
crm
sql injection
remote attacker
database retrieval

9.1 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

7.4 High

AI Score

Confidence

Low

0.0004 Low

EPSS

Percentile

9.0%

Vulnerabilities in Dolibarr ERP - CRM that affect version 9.0.1 and allow SQL injection. These vulnerabilities could allow a remote attacker to send a specially crafted SQL query to the system and retrieve all the information stored in the database through the parameters

viewstatut in /dolibarr/commande/list.php.

Affected configurations

Vulners
Node
dolibarrdolibarr_erp\/crmRange9.0.1

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "ERP CMS",
    "vendor": "Dolibarr",
    "versions": [
      {
        "status": "affected",
        "version": "9.0.1"
      }
    ]
  }
]

9.1 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

7.4 High

AI Score

Confidence

Low

0.0004 Low

EPSS

Percentile

9.0%