CVE-2019-11201
High
Description
Dolibarr ERP/CRM 9.0.1 provides a module named website that provides for creation of public websites with a WYSIWYG editor. It was identified that the editor also allowed inclusion of dynamic code, which can lead to code execution on the host machine. An attacker has to check a setting on the same page, which specifies the inclusion of dynamic content. Thus, a lower privileged user of the application can execute code under the context and permissions of the underlying web server.
SeverityHigh
CVSS8.0
Exploit probability—
ProductDolibarr Erp\/crm
PublishedJul 29, 2019
First seenJul 29, 2019
How to fix
Update
- dolibarr/dolibarr9.0.3 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| dolibarr dolibarr_erp\/crm | 9.0.1 | — |
| dolibarr/dolibarrPackagist | v < 9.0.3 | 9.0.3 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.