CVE-2019-11201: Code Injection
Dolibarr ERP/CRM 9.0.1 provides a module named website that provides for creation of public websites with a WYSIWYG editor. It was identified that the editor also allowed inclusion of dynamic code, which can lead to code execution on the host machine. An attacker has to check a setting on the same page, which specifies the inclusion of dynamic content. Thus, a lower privileged user of the application can execute code under the context and permissions of the underlying web server.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2019-11201?
CVE-2019-11201 is considered a critical vulnerability due to its potential for remote code execution.
How do I fix CVE-2019-11201?
To fix CVE-2019-11201, upgrade Dolibarr ERP/CRM to version 9.0.2 or higher, which addresses the vulnerability.
Who is affected by CVE-2019-11201?
CVE-2019-11201 affects users of Dolibarr ERP/CRM version 9.0.1.
What type of vulnerability is CVE-2019-11201?
CVE-2019-11201 is a code execution vulnerability that allows attackers to execute arbitrary code on the host system.
What conditions enable exploitation of CVE-2019-11201?
Exploitation of CVE-2019-11201 requires that the dynamic code inclusion feature in the WYSIWYG editor is enabled.