CVE-2019-11200: High severity dolibarr erp & crm vulnerability
Dolibarr ERP/CRM 9.0.1 provides a web-based functionality that backs up the database content to a dump file. However, the application performs insufficient checks on the export parameters to mysqldump, which can lead to execution of arbitrary binaries on the server. (Malicious binaries can be uploaded by abusing other functionalities of the application.)
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2019-11200?
CVE-2019-11200 has a medium severity rating due to the potential for arbitrary code execution via insufficient checks on export parameters.
How do I fix CVE-2019-11200?
To fix CVE-2019-11200, upgrade Dolibarr ERP/CRM to version 9.0.3 or later where the vulnerability has been addressed.
What versions of Dolibarr ERP/CRM are affected by CVE-2019-11200?
CVE-2019-11200 specifically affects Dolibarr ERP/CRM version 9.0.1.
Can CVE-2019-11200 allow remote code execution?
Yes, CVE-2019-11200 enables an attacker to execute arbitrary binaries on the server due to insufficient parameter validation.
What components are primarily impacted by CVE-2019-11200?
CVE-2019-11200 primarily impacts the web-based database backup functionality of Dolibarr ERP/CRM.