GHSA-p73x-rpgm-3v56

Dolibarr ERP CRM Code Injection vulnerability during installation

Source: GitHub Advisory Database (reviewed) Moderate CVE-2024-29477

Packages

Ecosystem	Package	Affected	Fixed in
Packagist	dolibarr/dolibarr	<= 19.0.0	no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

Lack of sanitization during Installation Process in Dolibarr ERP CRM up to version 19.0.0 allows an attacker with adjacent access to the network to execute arbitrary code via a specifically crafted input.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2024-29477 advisory
https://github.com/Dolibarr/dolibarr package
https://github.com/alexbsec/CVEs/blob/master/2024/CVE-2024-29477.md web
http://dolibarr.com web