CVE-2021-33816
Critical
Description
The website builder module in Dolibarr 13.0.2 allows remote PHP code execution because of an incomplete protection mechanism in which system, exec, and shell_exec are blocked but backticks are not blocked.
SeverityCritical
CVSS9.8
Exploit probability—
ProductDolibarr Erp\/crm
PublishedNov 10, 2021
First seenNov 10, 2021
How to fix
Update
- dolibarr/dolibarr14.0.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| dolibarr dolibarr_erp\/crm | 13.0.2 | — |
| dolibarr/dolibarrPackagist | 13.0.2 ≤ v < 14.0.0 | 14.0.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.