We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.

Please see our statement on Data Privacy.

Crisp.chat (Helpdesk and Chat)

Ok

THREATINT
PUBLISHED

CVE-2023-4198

Dolibarr ERP CRM (<= 17.0.3) Improper Access Control



AssignerSTAR_Labs
Reserved2023-08-07
Published2023-11-01
Updated2024-09-05

Description

Improper Access Control in Dolibarr ERP CRM <= v17.0.3 allows an unauthorized authenticated user to read a database table containing customer data



MEDIUM: 6.5CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Problem types

CWE-862 Missing Authorization

Product status

Default status
0x40038df590

Any version
affected

Credits

Poh Jia Hao (@Chocologicall) of STAR Labs SG Pte. Ltd. (@starlabs_sg) 0x40038df5f0

References

https://starlabs.sg/advisories/23/23-4198 third-party-advisory

https://github.com/Dolibarr/dolibarr/commit/3065b9ca6ade988e8d7a8a8550415c0abb56b9cb#diff-7d68365a708c954051853ade884c7e97c6ff13150ee92657d6ffc8603e0f947b patch

cve.org CVE-2023-4198

nvd.nist.gov CVE-2023-4198

Download JSON

Share this page
https://cve.threatint.com/CVE/CVE-2023-4198
Subscribe to our newsletter to learn more about our work.