CVE-2020-14201
First published: Fri Aug 21 2020(Updated: )
Dolibarr CRM before 11.0.5 allows privilege escalation. This could allow remote authenticated attackers to upload arbitrary files via societe/document.php in which "disabled" is changed to "enabled" in the HTML source code.
Credit: cve@mitre.org cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| composer/dolibarr/dolibarr | <11.0.5 | 11.0.5 |
| Dolibarr Dolibarr | <11.0.5 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://nvd.nist.gov/vuln/detail/CVE-2020-14201
- https://www.wizlynxgroup.com/security-research-advisories/vuln/WLX-2020-011
- https://github.com/Dolibarr/dolibarr/blob/e76641c491e4105e9cb1ded6149771c621d822b5/ChangeLog#L2933
- https://github.com/advisories/GHSA-25h3-mw3p-w8r7 (Advisory)
- https://github.com/Dolibarr/dolibarr/blob/develop/ChangeLog
Frequently Asked Questions
What is CVE-2020-14201?
CVE-2020-14201 is a vulnerability in Dolibarr CRM that allows privilege escalation, enabling authenticated attackers to upload arbitrary files.
How can remote attackers exploit this vulnerability?
Remote attackers can exploit this vulnerability by changing "disabled" to "enabled" in the HTML source code of societe/document.php, allowing them to upload arbitrary files.
What is the severity rating of CVE-2020-14201?
CVE-2020-14201 has a severity rating of 6.5, which is considered medium.
What is the affected software?
The affected software is Dolibarr CRM before version 11.0.5.
How do I fix CVE-2020-14201?
To fix CVE-2020-14201, upgrade your Dolibarr CRM to version 11.0.5 or later.
- collector/github-advisory-latest
- alias/GHSA-25h3-mw3p-w8r7
- alias/CVE-2020-14201
- collector/github-advisory
- collector/nvd-index
- collector/nvd-cve
- agent/type
- agent/softwarecombine
- agent/author
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/severity
- agent/references
- agent/weakness
- agent/tags
- agent/description
- agent/first-publish-date
- agent/event
- agent/trending
- package-manager/composer
- vendor/dolibarr
- canonical/dolibarr dolibarr