CVE-2022-40871
Critical
Description
Dolibarr ERP & CRM <=15.0.3 is vulnerable to Eval injection. By default, any administrator can be added to the installation page of dolibarr, and if successfully added, malicious code can be inserted into the database and then execute it by eval.
SeverityCritical
CVSS9.8
Exploit probability—
ProductDolibarr Erp\/crm
PublishedOct 12, 2022
First seenOct 12, 2022
Weakness typeCWE-94Code injection
How to fix
Sources list no fixed version or patch link for this vulnerability.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| dolibarr dolibarr_erp\/crm | v ≤ 15.0.3 | — |
| dolibarr/dolibarrPackagist | v ≤ 15.0.3 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.