CVE-2023-4198 — Missing Authorization in Dolibarr

CWE-862 — Missing Authorization5 documents4 sources
Severity
6.5MEDIUMNVD
EPSS
0.1%
top 76.49%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
DolibarrDolibarr ERP CRM
Timeline
PublishedNov 1

Description

Improper Access Control in Dolibarr ERP CRM <= v17.0.3 allows an unauthorized authenticated user to read a database table containing customer data

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:NExploitability: 2.8 | Impact: 3.6

Affected Packages3 packages

▶Packagistdolibarr/dolibarr< 18.0.0
▶CVEListV5dolibarr/dolibarr_erp_crm17.0.3

Patches

Patch: github.com ↗Patch: github.com ↗

🔴Vulnerability Details

4
OSV
Dolibarr Improper Input Validation vulnerability↗2023-11-01
▶
CVEList
Dolibarr ERP CRM (<= 17.0.3) Improper Access Control↗2023-11-01
▶
OSV
CVE-2023-4198: Improper Access Control in Dolibarr ERP CRM <= v17↗2023-11-01
▶
GHSA
Dolibarr Improper Input Validation vulnerability↗2023-11-01
▶
CVE-2023-4198 — Missing Authorization in Dolibarr | cvebase