GitHub Advisoryadvisory · Packagist
GHSA-6j62-m2vv-wc3m Dolibarr arbitrary commands execution
HIGH
Official page ↗
- Aliases
- CVE-2018-10092
- Ecosystem
- Packagist
- Packages
- dolibarr/dolibarr
- Severity
- High
- CVSS vector
- CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
- Weaknesses
- CWE-862
- Reviewed
- 2024-04-24
Affected packages
• Packagist dolibarr/dolibarr: < 7.0.2 → fixed in 7.0.2
Description
The admin panel in Dolibarr before 7.0.2 might allow remote attackers to execute arbitrary commands by leveraging support for updating the antivirus command and parameters used to scan file uploads.
Related
Alias · CVE (1)
- CVE-2018-10092 The admin panel in Dolibarr before 7.0.2 might allow remote attackers to execute arbitrary commands by leveraging support for updating the… vulnerability
Weakness · CWE (1)
- CWE-862 Missing Authorization weakness
References
- https://nvd.nist.gov/vuln/detail/CVE-2018-10092 advisory
- https://github.com/Dolibarr/dolibarr/commit/5d121b2d3ae2a95abebc9dc31e4782cbc61a1f39 web
- https://github.com/Dolibarr/dolibarr package
- https://github.com/Dolibarr/dolibarr/blob/7.0.2/ChangeLog web
- https://sysdream.com/news/lab/2018-05-21-cve-2018-10092-dolibarr-admin-panel-authenticated-remote-code-execution-rce-vulnerability web
- http://www.openwall.com/lists/oss-security/2018/05/21/2 web