PT-2017-19210 · Dolibarr · Dolibarr Erp/Crm

Yann Chalenã§On · Published 2017-06-25 · Updated 2022-05-17 · CVE-2017-9840

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Dolibarr ERP/CRM versions 5.0.3 and prior

Description The issue allows low-privilege users to upload files of dangerous types, potentially resulting in arbitrary code execution within the context of the vulnerable application.

Recommendations For versions 5.0.3 and prior, restrict file upload capabilities to prevent the upload of dangerous file types until a fix is available. As a temporary workaround, consider disabling file upload functionality for low-privilege users to minimize the risk of exploitation.

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2017-9840

GHSA-CWGM-QW8V-HRRG

Affected Products

Dolibarr Erp/Crm

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2017-9840 · Security Note
• https://osv.dev/vulnerability/GHSA-cwgm-qw8v-hrrg · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-9840 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2017-9840 · Security Note
• https://ubuntu.com/security/CVE-2017-9840 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2017-9840 · Vendor Advisory
• https://wizlynxgroup.com/security-research-advisories/vuln/WLX-2017-009 · Note