PT-2017-19210 · Dolibarr · Dolibarr Erp/Crm

Yann Chalenã§On · Publicado 2017-06-25 · Atualizado 2022-05-17 · CVE-2017-9840

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Dolibarr ERP/CRM versions 5.0.3 and prior

Description The issue allows low-privilege users to upload files of dangerous types, potentially resulting in arbitrary code execution within the context of the vulnerable application.

Recommendations For versions 5.0.3 and prior, restrict file upload capabilities to prevent the upload of dangerous file types until a fix is available. As a temporary workaround, consider disabling file upload functionality for low-privilege users to minimize the risk of exploitation.

Correção

Unrestricted File Upload

Enumeração de Fraquezas

CWE-434

Identificadores relacionados

CVE-2017-9840

GHSA-CWGM-QW8V-HRRG

Produtos afetados

Dolibarr Erp/Crm

Referências · 7

• https://wizlynxgroup.com/security-research-advisories/vuln/WLX-2017-009 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2017-9840 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-cwgm-qw8v-hrrg · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2017-9840 · Aviso do Fabricante
• https://cve.org/CVERecord?id=CVE-2017-9840 · Nota de Segurança
• https://ubuntu.com/security/CVE-2017-9840 · Aviso do Fabricante
• https://osv.dev/vulnerability/UBUNTU-CVE-2017-9840 · Aviso do Fabricante