CVE-2020-12669

EPSS 0.29%
Published 06.05.2020 19:15:12
Last modified 21.11.2024 05:00:02
Source cve@mitre.org
Teams watchlist Login
Open Login

core/get_menudiv.php in Dolibarr before 11.0.4 allows remote authenticated attackers to bypass intended access restrictions via a non-alphanumeric menu parameter.

Affected products Warnungen 0 Metrics 3 CWE 1 References 5

Data is provided by the National Vulnerability Database (NVD)

Dolibarr ≫ Dolibarr Version < 11.0.4

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Type	Source	Score	Percentile
EPSS	FIRST.org	0.29%	0.519

CVSS Metriken
Source	Base Score	Exploit Score	Impact Score	Vector string
nvd@nist.gov	8.8	2.8	5.9	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvd@nist.gov	6.5	8	6.4	AV:N/AC:L/Au:S/C:P/I:P/A:P

CWE-20 Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

https://github.com/Dolibarr/dolibarr/commit/c1b530f58f6f01081ddbeaa2092ef308c3ec2727

Patch

Third Party Advisory

https://sourceforge.net/projects/dolibarr/files/Dolibarr%20ERP-CRM/11.0.4/

Third Party Advisory

Product

https://nvd.nist.gov/vuln/detail/CVE-2020-12669

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2020-12669

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2020-12669

EUVD