Veracode Vulnerability DatabaseVERACODE:40987Information Disclosure
7.5 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
0.569 Medium
EPSS
Percentile
97.7%
dolibarr/dolibarr is vulnerable to Information Disclosure. A remote unauthenticated attacker is able to gain access to company’s entire customer files, prospects, suppliers, and employee information, when a contact file exists via performing a database dump, resulting in the disclosure of sensitive information.
| CPE | Name | Operator | Version |
|---|---|---|---|
| dolibarr/dolibarr | le | 16.0.4 | |
| dolibarr/dolibarr | le | 16.0.4 |
References
github.com/Dolibarr/dolibarr/commit/bb7b69ef43673ed403436eac05e0bc31d5033ff7
github.com/Dolibarr/dolibarr/commit/be82f51f68d738cce205f4ce5b469ef42ed82d9e
github.com/Dolibarr/dolibarr/pull/24245
www.dolibarr.org/forum/t/dolibarr-16-0-security-breach/23471
www.dolibarr.org/forum/t/dolibarr-16-0-security-breach/23471/1
www.dsecbypass.com/en/dolibarr-pre-auth-contact-database-dump/
Related
7.5 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
0.569 Medium
EPSS
Percentile
97.7%