CVE-2019-11200
First published: Mon Jul 29 2019(Updated: )
Dolibarr ERP/CRM 9.0.1 provides a web-based functionality that backs up the database content to a dump file. However, the application performs insufficient checks on the export parameters to mysqldump, which can lead to execution of arbitrary binaries on the server. (Malicious binaries can be uploaded by abusing other functionalities of the application.)
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| composer/dolibarr/dolibarr | <9.0.3 | 9.0.3 |
| Dolibarr ERP & CRM | =9.0.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://nvd.nist.gov/vuln/detail/CVE-2019-11200
- https://know.bishopfox.com/advisories/dolibarr-version-9-0-1-vulnerabilities
- https://github.com/Dolibarr/dolibarr/issues/10984#issuecomment-488297419
- https://github.com/Dolibarr/dolibarr/commit/d6ae62478c8841fdfe58971494818b599f396d4f
- https://github.com/Dolibarr/dolibarr/commit/01075081cbcd9130a72115cdb50ee61fc394edc1
- https://github.com/advisories/GHSA-2rwh-262r-r85j (Advisory)
Frequently Asked Questions
What is the severity of CVE-2019-11200?
CVE-2019-11200 has a medium severity rating due to the potential for arbitrary code execution via insufficient checks on export parameters.
How do I fix CVE-2019-11200?
To fix CVE-2019-11200, upgrade Dolibarr ERP/CRM to version 9.0.3 or later where the vulnerability has been addressed.
What versions of Dolibarr ERP/CRM are affected by CVE-2019-11200?
CVE-2019-11200 specifically affects Dolibarr ERP/CRM version 9.0.1.
Can CVE-2019-11200 allow remote code execution?
Yes, CVE-2019-11200 enables an attacker to execute arbitrary binaries on the server due to insufficient parameter validation.
What components are primarily impacted by CVE-2019-11200?
CVE-2019-11200 primarily impacts the web-based database backup functionality of Dolibarr ERP/CRM.
- collector/github-advisory-latest
- alias/GHSA-2rwh-262r-r85j
- alias/CVE-2019-11200
- collector/github-advisory
- agent/type
- agent/references
- agent/author
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/last-modified-date
- agent/description
- agent/first-publish-date
- agent/event
- agent/trending
- agent/source
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- collector/nvd-cve
- package-manager/composer
- vendor/dolibarr
- canonical/dolibarr erp & crm
- version/dolibarr erp & crm/9.0.1