CVE-2020-35136: Command Injection

Q: What is the vulnerability ID for this issue?

The vulnerability ID for this issue is CVE-2020-35136.

Q: What is the severity of CVE-2020-35136?

The severity of CVE-2020-35136 is critical with a CVSS score of 7.2.

Q: How does the vulnerability in Dolibarr 12.0.3 occur?

The vulnerability in Dolibarr 12.0.3 occurs due to a flaw in the backup function of the admin dashboard, which allows an authenticated attacker to execute remote code.

Q: Who can exploit CVE-2020-35136?

An attacker who has access to the admin dashboard in Dolibarr 12.0.3 can exploit CVE-2020-35136.

Q: Is there a fix available for CVE-2020-35136?

Yes, a fix for CVE-2020-35136 is available. It is recommended to update to a patched version of Dolibarr.

Published Dec 23, 2020

Updated

Dolibarr 12.0.3 is vulnerable to authenticated Remote Code Execution. An attacker who has the access the admin dashboard can manipulate the backup function by inserting a payload into the filename for the zipfilenametemplate parameter to admin/tools/dolibarrexport.php.

Affected Software

2 affected componentsFixes available

composer/dolibarr/dolibarr<=12.0.3

12.0.4

dolibarr Dolibarr Erp\/crm=12.0.3

Remediation

Patch Available

https://github.com/Dolibarr/dolibarr/commit/4fcd3fe49332baab0e424225ad10b76b47ebcbac

Event History

Dec 23, 2020

CVE Published

via MITRE·02:39 PM

Data Sourced

via MITRE·02:39 PM

Description

May 24, 2022

Advisory Published

via GitHub·05:37 PM

Frequently Asked Questions

What is the vulnerability ID for this issue?

The vulnerability ID for this issue is CVE-2020-35136.

What is the severity of CVE-2020-35136?

The severity of CVE-2020-35136 is critical with a CVSS score of 7.2.

How does the vulnerability in Dolibarr 12.0.3 occur?