PT-2024-28793 · Unknown · Dolibarr Erp/Crm

Tomas Castro Rojas · Published 2024-07-24 · Updated 2024-08-01 · CVE-2024-40137

Positive Technologies (AI Summary)

CVSS v4.0

7.0

High

Base vector

AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Dolibarr ERP CRM versions prior to 19.0.2

Description The issue is related to a remote code execution (RCE) vulnerability. It can be exploited via the Computed field parameter under the Users Module Setup function.

Recommendations For versions prior to 19.0.2, update to version 19.0.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the Users Module Setup function until a patch is applied.

Exploit

Fix

Special Elements Injection

Weakness Enumeration

CWE-74

Related Identifiers

CVE-2024-40137

GHSA-VPRP-94P9-5JP8

Affected Products

Dolibarr Erp/Crm

References · 8

• 🔥 https://github.com/c0d3x27/CVEs/tree/main/CVE-2024-40137 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-40137 · Security Note
• https://cve.org/CVERecord?id=CVE-2024-40137 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-40137 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-vprp-94p9-5jp8 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-40137 · Vendor Advisory
• https://github.com/Dolibarr/dolibarr · Note
• https://t.me/cvedetector/1587 · Telegram Post