CVE-2023-4198 | THREATINT

We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.

Please see our statement on Data Privacy.

Crisp.chat (Helpdesk and Chat)

Ok

Assigner	STAR_Labs
Reserved	2023-08-07
Published	2023-11-01
Updated	2024-09-05

Description

Improper Access Control in Dolibarr ERP CRM <= v17.0.3 allows an unauthorized authenticated user to read a database table containing customer data

MEDIUM: 6.5

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Problem types

CWE-862 Missing Authorization

Product status

Default status

0x40038df590

Any version

affected

Credits

Poh Jia Hao (@Chocologicall) of STAR Labs SG Pte. Ltd. (@starlabs_sg) 0x40038df5f0

References

https://starlabs.sg/advisories/23/23-4198 third-party-advisory

https://github.com/Dolibarr/dolibarr/commit/3065b9ca6ade988e8d7a8a8550415c0abb56b9cb#diff-7d68365a708c954051853ade884c7e97c6ff13150ee92657d6ffc8603e0f947b patch

cve.org CVE-2023-4198

nvd.nist.gov CVE-2023-4198

Download JSON

https://cve.threatint.com/CVE/CVE-2023-4198

Subscribe to our newsletter to learn more about our work.