CVE-2020-12669: Input Validation
First published: Wed May 06 2020(Updated: )
core/get_menudiv.php in Dolibarr before 11.0.4 allows remote authenticated attackers to bypass intended access restrictions via a non-alphanumeric menu parameter.
Credit: cve@mitre.org cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Dolibarr Dolibarr | <11.0.4 | |
| composer/dolibarr/dolibarr | <12.0.0 | 12.0.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://github.com/Dolibarr/dolibarr/commit/c1b530f58f6f01081ddbeaa2092ef308c3ec2727
- https://sourceforge.net/projects/dolibarr/files/Dolibarr%20ERP-CRM/11.0.4/
- https://nvd.nist.gov/vuln/detail/CVE-2020-12669
- https://sourceforge.net/projects/dolibarr/files/Dolibarr%20ERP-CRM/11.0.4
- https://github.com/advisories/GHSA-rg8m-84jf-9367 (Advisory)
Frequently Asked Questions
What is the vulnerability ID for this Dolibarr vulnerability?
The vulnerability ID for this Dolibarr vulnerability is CVE-2020-12669.
What is the severity of CVE-2020-12669?
CVE-2020-12669 has a severity rating of 8.8 (high).
How does Dolibarr before version 11.0.4 allow remote attackers to bypass access restrictions?
Dolibarr before version 11.0.4 allows remote authenticated attackers to bypass intended access restrictions via a non-alphanumeric menu parameter in the core/get_menudiv.php script.
What is the affected software for CVE-2020-12669?
The affected software for CVE-2020-12669 is Dolibarr ERP/CRM versions up to and excluding 11.0.4.
How can I fix the Dolibarr vulnerability CVE-2020-12669?
To fix the Dolibarr vulnerability CVE-2020-12669, it is recommended to upgrade to version 11.0.4 or later.
- collector/nvd-index
- agent/type
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-rg8m-84jf-9367
- alias/CVE-2020-12669
- agent/software-canonical-lookup
- agent/weakness
- agent/references
- agent/author
- agent/remedy
- agent/severity
- agent/description
- collector/nvd-cve
- source/NVD
- agent/softwarecombine
- collector/github-advisory
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/tags
- agent/first-publish-date
- agent/event
- agent/trending
- vendor/dolibarr
- canonical/dolibarr dolibarr
- package-manager/composer