PT-2022-13396 · Dolibarr · Dolibarr

Published 2022-02-23 · Updated 2025-04-03 · CVE-2022-0731

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions dolibarr/dolibarr versions prior to 16.0

Description The issue is related to Improper Access Control (IDOR) in the dolibarr/dolibarr GitHub repository. It affects the userphoto module, potentially leading to data exposure. The exposed data may include sensitive information about contacts, suppliers, invoices, orders, stocks, agenda, accounting, and more.

Recommendations For versions prior to 16.0, update to version 16.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the userphoto module to minimize the risk of exploitation.

Exploit

Fix

Improper Access Control

IDOR

Incorrect Authorization

Weakness Enumeration

CWE-284

CWE-639

CWE-863

Related Identifiers

BIT-DOLIBARR-2022-0731

CVE-2022-0731

GHSA-4XC7-X2JR-CR74

Affected Products

Dolibarr

References · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/0xxx/CVE-2022-0731.json · Exploit
• 🔥 https://huntr.dev/bounties/e242ab4e-fc70-4b2c-a42d-5b3ee4895de8 · Exploit
• https://github.com/dolibarr/dolibarr/commit/209ab708d4b65fbd88ba4340d60b7822cb72651a · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-0731 · Security Note
• https://osv.dev/vulnerability/CVE-2022-0731 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-4xc7-x2jr-cr74 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-0731 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-dolibarr-2022-0731 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-0731 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-0731 · Security Note
• https://github.com/dolibarr/dolibarr · Note
• https://t.me/cvenotify/27606 · Telegram Post
• https://t.me/cibsecurity/37967 · Telegram Post