Vulnerability · Published Jun 13, 2023 · Assigned by mitre
CVE-2023-33568
High 7.5
In plain English
A high-severity security flaw in the dolibarr/dolibarr package (Packagist). Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 14.9% (higher than 97% of all known vulnerabilities). Ready-made attack tooling exists: Metasploit, Nuclei. Fixed versions are available - upgrade the affected package.
Severity (CVSS NVD)7.5High
Exploit odds (30 days)14.9%top 3.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack tooling2Metasploit, Nuclei
Official description
An issue in Dolibarr 16 before 16.0.5 allows unauthenticated attackers to perform a database dump and access a company's entire customer file, prospects, suppliers, and employee information if a contact file exists.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Packagist | dolibarr/dolibarr | 16.0.5 | GHSA-fpvg-m786-h5vr |
Affected products (as reported)
References
- https://www.dsecbypass.com/en/dolibarr-pre-auth-contact-database-dump/
- https://www.dolibarr.org/forum/t/dolibarr-16-0-security-breach/23471/1
- https://github.com/Dolibarr/dolibarr/commit/bb7b69ef43673ed403436eac05e0bc31d5033ff7
- https://github.com/Dolibarr/dolibarr/commit/be82f51f68d738cce205f4ce5b469ef42ed82d9e
- https://www.dolibarr.org/forum/t/dolibarr-16-0-security-breach/23471