PT-2019-12179 · Dolibarr · Dolibarr Erp/Crm

Priyank Nigam · Published 2019-07-29 · Updated 2022-05-24 · CVE-2019-11201

Positive Technologies (AI Summary)

CVSS v2.0

8.5

High

Base vector

AV:N/AC:M/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Dolibarr ERP/CRM version 9.0.1

Description The issue concerns the website module in Dolibarr ERP/CRM, which includes a WYSIWYG editor for creating public websites. This editor allows the inclusion of dynamic code, potentially leading to code execution on the host machine. An attacker, who must be a lower-privileged user of the application, can exploit this by checking a specific setting on the same page that enables the inclusion of dynamic content. As a result, code can be executed under the context and permissions of the underlying web server.

Recommendations For Dolibarr ERP/CRM version 9.0.1, consider disabling the WYSIWYG editor in the website module until a patch is available to prevent the inclusion of dynamic code and potential code execution. Restrict access to the website module to minimize the risk of exploitation.

Exploit

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2019-11201

GHSA-JWG3-V9XM-V6Q9

Affected Products

Dolibarr Erp/Crm

References · 10

• 🔥 https://know.bishopfox.com/advisories/dolibarr-version-9-0-1-vulnerabilities · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-11201 · Security Note
• https://ubuntu.com/security/CVE-2019-11201 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-11201 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2019-11201 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2019-11201 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-jwg3-v9xm-v6q9 · Vendor Advisory
• https://github.com/Dolibarr/dolibarr · Note
• https://github.com/Dolibarr/dolibarr/commit/63c0ab93fb21f86c1b736061af9fa1eee90148fd · Note
• https://github.com/Dolibarr/dolibarr/issues/10984#issuecomment-485841141 · Note