PT-2020-2779 · Dolibarr · Dolibarr

Published 2020-05-06 · Updated 2022-05-24 · CVE-2020-12669

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Dolibarr versions prior to 11.0.4

Description The issue is related to the core/get menudiv.php component in Dolibarr, which lacks proper input validation. This allows remote authenticated attackers to bypass intended access restrictions by providing a non-alphanumeric menu parameter, potentially leading to unauthorized access to protected information.

Recommendations For versions prior to 11.0.4, update to version 11.0.4 or later to resolve the issue. As a temporary workaround, consider restricting access to the core/get menudiv.php component until a patch is applied. Avoid using non-alphanumeric characters in the menu parameter to minimize the risk of exploitation.

Fix

Incorrect Authorization

RCE

Weakness Enumeration

CWE-863

CWE-20

Related Identifiers

BDU:2020-02874

CVE-2020-12669

GHSA-RG8M-84JF-9367

Affected Products

Dolibarr

References · 11

• https://github.com/Dolibarr/dolibarr/commit/c1b530f58f6f01081ddbeaa2092ef308c3ec2727 · Patch
• https://ubuntu.com/security/CVE-2020-12669 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2020-12669 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2020-12669 · Security Note
• https://bdu.fstec.ru/vul/2020-02874 · Security Note
• https://osv.dev/vulnerability/GHSA-rg8m-84jf-9367 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-12669 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-12669 · Vendor Advisory
• https://github.com/Dolibarr/dolibarr · Note
• https://sourceforge.net/projects/dolibarr/files/Dolibarr%20ERP-CRM/11.0.4 · Note
• https://t.me/cvenotify/3605 · Telegram Post