~ / search / GHSA-25h3-mw3p-w8r7

GHSA-25h3-mw3p-w8r7

Dolibarr CRM allows Privilege Escalation

Source: GitHub Advisory Database (reviewed) Moderate CVE-2020-14201

Packages

EcosystemPackageAffectedFixed in
Packagist dolibarr/dolibarr < 11.0.5 11.0.5

Details

As written in the advisory (Markdown source, shown as plain text).

Dolibarr CRM before 11.0.5 allows privilege escalation. This could allow remote authenticated attackers to upload arbitrary files via societe/document.php in which "disabled" is changed to "enabled" in the HTML source code.

References

External links from the advisory. They lead to third-party sites.