Dolibarr ERP CRM 13.0.2

CPE Details

Dolibarr ERP CRM 13.0.2
dolibarr
dolibarr_erp\/crm
13.0.2
2022-04-11
09h07 +00:00
2022-11-17
16h21 +00:00
CPE NVD
Alerte pour un CPE
Restez informé de toutes modifications pour un CPE spécifique.
Gestion des notifications

CPE Name: cpe:2.3:a:dolibarr:dolibarr_erp\/crm:13.0.2:*:*:*:*:*:*:*

Informations

Vendor

dolibarr

Product

dolibarr_erp\/crm

Version

13.0.2

Related CVE

Open and find in CVE List

CVE ID Publié Description Score Gravité
CVE-2021-3991 2024-11-15 10h52 +00:00 An Improper Authorization vulnerability exists in Dolibarr versions prior to the 'develop' branch. A user with restricted permissions in the 'Reception' section is able to access specific reception details via direct URL access, bypassing the intended permission restrictions.
4.3
Moyen
CVE-2024-29477 2024-04-03 00h00 +00:00 Lack of sanitization during Installation Process in Dolibarr ERP CRM up to version 19.0.0 allows an attacker with adjacent access to the network to execute arbitrary code via a specifically crafted input.
8.8
Haute
CVE-2023-4198 2023-11-01 08h01 +00:00 Improper Access Control in Dolibarr ERP CRM <= v17.0.3 allows an unauthorized authenticated user to read a database table containing customer data
6.5
Moyen
CVE-2023-4197 2023-11-01 07h58 +00:00 Improper input validation in Dolibarr ERP CRM <= v18.0.1 fails to strip certain PHP code from user-supplied input when creating a Website, allowing an attacker to inject and evaluate arbitrary PHP code.
8.8
Haute
CVE-2023-5842 2023-10-30 00h00 +00:00 Cross-site Scripting (XSS) - Stored in GitHub repository dolibarr/dolibarr prior to 16.0.5.
4.8
Moyen
CVE-2023-5323 2023-10-01 00h00 +00:00 Cross-site Scripting (XSS) - Generic in GitHub repository dolibarr/dolibarr prior to 18.0.
6.1
Moyen
CVE-2023-38886 2023-09-19 22h00 +00:00 An issue in Dolibarr ERP CRM v.17.0.1 and before allows a remote privileged attacker to execute arbitrary code via a crafted command/script.
7.2
Haute
CVE-2023-38887 2023-09-19 22h00 +00:00 File Upload vulnerability in Dolibarr ERP CRM v.17.0.1 and before allows a remote attacker to execute arbitrary code and obtain sensitive information via the extension filtering and renaming functions.
8.8
Haute
CVE-2023-38888 2023-09-19 22h00 +00:00 Cross Site Scripting vulnerability in Dolibarr ERP CRM v.17.0.1 and before allows a remote attacker to obtain sensitive information and execute arbitrary code via the REST API module, related to analyseVarsForSqlAndScriptsInjection and testSqlAndScriptInject.
9.6
Critique
CVE-2023-30253 2023-05-28 22h00 +00:00 Dolibarr before 17.0.1 allows remote code execution by an authenticated user via an uppercase manipulation:
8.8
Haute
CVE-2022-43138 2022-11-17 00h00 +00:00 Dolibarr Open Source ERP & CRM for Business before v14.0.1 allows attackers to escalate privileges via a crafted API.
9.8
Critique
CVE-2022-40871 2022-10-11 22h00 +00:00 Dolibarr ERP & CRM <=15.0.3 is vulnerable to Eval injection. By default, any administrator can be added to the installation page of dolibarr, and if successfully added, malicious code can be inserted into the database and then execute it by eval.
9.8
Critique
CVE-2022-2060 2022-06-13 06h50 +00:00 Cross-site Scripting (XSS) - Stored in GitHub repository dolibarr/dolibarr prior to 16.0.
5.4
Moyen
CVE-2021-37517 2022-03-31 16h06 +00:00 An Access Control vulnerability exists in Dolibarr ERP/CRM 13.0.2, fixed version is 14.0.0,in the forgot-password function becuase the application allows email addresses as usernames, which can cause a Denial of Service.
7.5
Haute
CVE-2021-36625 2022-03-31 15h50 +00:00 An SQL Injection vulnerability exists in Dolibarr ERP/CRM 13.0.2 (fixed version is 14.0.0) via a POST request to the country_id parameter in an UPDATE statement.
8.8
Haute
CVE-2022-0819 2022-03-02 14h40 +00:00 Code Injection in GitHub repository dolibarr/dolibarr prior to 15.0.1.
8.8
Haute
CVE-2022-0746 2022-02-25 08h05 +00:00 Business Logic Errors in GitHub repository dolibarr/dolibarr prior to 16.0.
4.3
Moyen
CVE-2022-0731 2022-02-23 17h35 +00:00 Improper Access Control (IDOR) in GitHub repository dolibarr/dolibarr prior to 16.0.
6.5
Moyen
CVE-2022-0414 2022-01-30 23h00 +00:00 Improper Validation of Specified Quantity in Input in Packagist dolibarr/dolibarr prior to 16.0.
4.3
Moyen
CVE-2022-0224 2022-01-14 16h35 +00:00 dolibarr is vulnerable to Improper Neutralization of Special Elements used in an SQL Command
9.8
Critique
CVE-2022-0174 2022-01-10 16h30 +00:00 Improper Validation of Specified Quantity in Input vulnerability in dolibarr dolibarr/dolibarr.
4.3
Moyen
CVE-2021-33618 2021-11-10 21h40 +00:00 Dolibarr ERP and CRM 13.0.2 allows XSS via object details, as demonstrated by > and < characters in the onpointermove attribute of a BODY element to the user-management feature.
6.1
Moyen
CVE-2021-33816 2021-11-10 21h37 +00:00 The website builder module in Dolibarr 13.0.2 allows remote PHP code execution because of an incomplete protection mechanism in which system, exec, and shell_exec are blocked but backticks are not blocked.
9.8
Critique
Les informations affichées sur CVE Find proviennent de plusieurs sources de référence rigoureusement sélectionnées. Les données CVE sont fournies par MITRE Corporation et la National Vulnerability Database (NVD). Le catalogue des vulnérabilités activement exploitées (KEV) provient de la Cybersecurity and Infrastructure Security Agency (CISA), tandis que les scores EPSS sont issus de FIRST.org. Enfin, les données relatives aux faiblesses logicielles (CWE) et aux schémas d'attaque courants (CAPEC) sont maintenues par MITRE Corporation, et les informations sur les configurations logicielles et matérielles (CPE) proviennent du NVD.