CVE-2023-4197

HIGH7.5EPSS 53.3%

Dolibarr ERP CRM (<= 18.0.1) Improper Input Sanitization Authenticated RCE

發布日:2023/11/1修改日:2025/5/20

也稱為:GHSA-r9cm-pw9j-3fpxBIT-dolibarr-2023-4197

描述

Improper input validation in Dolibarr ERP CRM <= v18.0.1 fails to strip certain PHP code from user-supplied input when creating a Website, allowing an attacker to inject and evaluate arbitrary PHP code.

受影響套件(2)

Bitnami/dolibarrfrom 0, <= 18.0.1
Packagist/dolibarr/dolibarrfrom 0, < 18.0.2

CVSS 分數

來源	版本	嚴重程度	向量
osv	CVSS 3.1	HIGH7.5	CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

參考連結(4)

ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2023-4197
PATCHhttps://github.com/Dolibarr/dolibarr
WEBhttps://github.com/Dolibarr/dolibarr/commit/0ed6a63fb06be88be5a4f8bcdee83185eee4087e
WEBhttps://starlabs.sg/advisories/23/23-4197