Dolibarr ERP CRM Code Injection vulnerability during installation

2024-04-0312:31:06

Google

osv.dev

code injection

vulnerability

installation

sanitization

dolibarr erp crm

network access

arbitrary code

software

7.7 High

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

9.0%

JSON

Lack of sanitization during Installation Process in Dolibarr ERP CRM up to version 19.0.0 allows an attacker with adjacent access to the network to execute arbitrary code via a specifically crafted input.

CPENameOperatorVersion
dolibarr/dolibarreq9.0.4
dolibarr/dolibarreq3.7.2
dolibarr/dolibarreq4.0.6
dolibarr/dolibarreq10.0.1
dolibarr/dolibarreq10.0.4
dolibarr/dolibarreq15.0.0
dolibarr/dolibarreq7.0.1
dolibarr/dolibarreq5.0.0
dolibarr/dolibarreq10.0.2
dolibarr/dolibarreq5.0.5

Name	Operator	Version
dolibarr/dolibarr	eq	9.0.4
dolibarr/dolibarr	eq	3.7.2
dolibarr/dolibarr	eq	4.0.6
dolibarr/dolibarr	eq	10.0.1
dolibarr/dolibarr	eq	10.0.4
dolibarr/dolibarr	eq	15.0.0
dolibarr/dolibarr	eq	7.0.1
dolibarr/dolibarr	eq	5.0.0
dolibarr/dolibarr	eq	10.0.2
dolibarr/dolibarr	eq	5.0.5