CVE-2020-14209
High
Description
Dolibarr before 11.0.5 allows low-privilege users to upload files of dangerous types, leading to arbitrary code execution. This occurs because .pht and .phar files can be uploaded. Also, a .htaccess file can be uploaded to reconfigure access control (e.g., to let .noexe files be executed as PHP code to defeat the .noexe protection mechanism).
SeverityHigh
CVSS8.8
Exploit probability—
ProductDolibarr
PublishedSep 2, 2020
First seenSep 2, 2020
How to fix
Update
- dolibarr dolibarr11.0.5 or later
- dolibarr/dolibarr11.0.5 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| dolibarr dolibarr | v < 11.0.5 | 11.0.5 |
| dolibarr/dolibarrPackagist | v < 11.0.5 | 11.0.5 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.