CVE-2023-38886 — OS Command Injection in Dolibarr

CWE-78 — OS Command InjectionCWE-94 — Code Injection5 documents4 sources
Severity
7.2HIGHNVD
EPSS
50.4%
top 2.15%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
DolibarrDolibarr ERP CRM
Timeline
PublishedSep 20

Description

An issue in Dolibarr ERP CRM v.17.0.1 and before allows a remote privileged attacker to execute arbitrary code via a crafted command/script.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:HExploitability: 1.2 | Impact: 5.9

Affected Packages2 packages

▶Packagistdolibarr/dolibarr< 17.0.1

🔴Vulnerability Details

4
CVEList
CVE-2023-38886: An issue in Dolibarr ERP CRM v↗2023-09-20
▶
OSV
CVE-2023-38886: An issue in Dolibarr ERP CRM v↗2023-09-20
▶
OSV
Dolibarr allows a remote privileged attacker to execute arbitrary code via a crafted command/script↗2023-09-20
▶
GHSA
Dolibarr allows a remote privileged attacker to execute arbitrary code via a crafted command/script↗2023-09-20
▶
CVE-2023-38886 — OS Command Injection in Dolibarr | cvebase