CVE-2020-35136
HIGH
7,2
Source: [email protected]
Attack Vector: network
Attack Complexity: low
Privileges Required: high
User Interaction: none
Scope: unchanged
Confidentiality: high
Integrity: high
Availability: high
HIGH
9,0
Source: [email protected]
Access Vector: network
Access Complexity: low
Authentication: single
Confidentiality: complete
Integrity: complete
Availability: complete
Description
AI Translation Available
Dolibarr 12.0.3 is vulnerable to authenticated Remote Code Execution. An attacker who has the access the admin dashboard can manipulate the backup function by inserting a payload into the filename for the zipfilename_template parameter to admin/tools/dolibarr_export.php.
EPSS (Exploit Prediction Scoring System)
Trend Analysis
EPSS (Exploit Prediction Scoring System)
Prevede la probabilità di sfruttamento basata su intelligence sulle minacce e sulle caratteristiche della vulnerabilità.
EPSS Score
0,0699
Percentile
0,9th
Updated
EPSS Score Trend (Last 90 Days)
88
Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')
DraftCommon Consequences
Security Scopes Affected:
Confidentiality
Integrity
Availability
Other
Potential Impacts:
Execute Unauthorized Code Or Commands
Alter Execution Logic
Read Application Data
Modify Application Data
Applicable Platforms
Languages:
Not Language-Specific, PHP
Application
Dolibarr Erp\/Crm by Dolibarr
CPE Identifier
View Detailed Analysis
cpe:2.3:a:dolibarr:dolibarr_erp\/crm:12.0.3:*:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
http://bilishim.com/2020/12/18/zero-hunting-2.html
https://github.com/Dolibarr/dolibarr/commit/4fcd3fe49332baab0e424225ad10b76b47e…
https://github.com/Dolibarr/dolibarr/releases
https://sourceforge.net/projects/dolibarr/
http://bilishim.com/2020/12/18/zero-hunting-2.html
https://github.com/Dolibarr/dolibarr/commit/4fcd3fe49332baab0e424225ad10b76b47e…
https://github.com/Dolibarr/dolibarr/releases
https://sourceforge.net/projects/dolibarr/