Vulnerability · Published Oct 12, 2022 · Assigned by mitre
CVE-2022-40871
Critical 9.8
In plain English
A critical-severity code injection in the dolibarr/dolibarr package (Packagist). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 34.6% (higher than 98% of all known vulnerabilities).
Severity (CVSS 3.1)9.8Critical
Exploit odds (30 days)34.6%top 1.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Dolibarr ERP & CRM <=15.0.3 is vulnerable to Eval injection. By default, any administrator can be added to the installation page of dolibarr, and if successfully added, malicious code can be inserted into the database and then execute it by eval.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Packagist | dolibarr/dolibarr | no fix listed | GHSA-7cm4-vmf2-8wf2 |
Affected products (as reported)
Weakness: CWE-94 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H