Description

Dolibarr 12.0.3 is vulnerable to authenticated Remote Code Execution. An attacker who has the access the admin dashboard can manipulate the backup function by inserting a payload into the filename for the zipfilename_template parameter to admin/tools/dolibarr_export.php.

Remediation

References

CVE-2020-35136

Related Vulnerabilities

WordPress Plugin Ultimate Member-User Profile, Registration, Login, Member Directory, Content Restriction & Membership Cross-Site Scripting (1.2.3)

WordPress Plugin WooCommerce Extra Product Options Multiple Vulnerabilities (4.5.3)

WordPress Plugin All in One SEO-Best WordPress SEO-Easily Improve SEO Rankings & Increase Traffic Multiple Vulnerabilities (4.1.5.2)

PostgreSQL Permissions, Privileges, and Access Controls Vulnerability (CVE-2007-6600)

GlassFish CVE-2017-10393 Vulnerability (CVE-2017-10393)

Severity

High

Classification

CVE-2020-35136 CWE-138 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Tags

Missing Update Known Vulnerabilities