CVE-2023-38887: Malicious File Upload
File Upload vulnerability in Dolibarr ERP CRM v.17.0.1 and before allows a remote attacker to execute arbitrary code and obtain sensitive information via the extension filtering and renaming functions.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/dolibarr/dolibarrto a version that resolves this vulnerability.Fixed in 17.0.1
Event History
Frequently Asked Questions
What is CVE-2023-38887?
CVE-2023-38887 is a file upload vulnerability in Dolibarr ERP CRM v.17.0.1 and before that allows a remote attacker to execute arbitrary code and obtain sensitive information.
How does CVE-2023-38887 affect Dolibarr ERP CRM?
CVE-2023-38887 allows a remote attacker to exploit the extension filtering and renaming functions in Dolibarr ERP CRM, enabling them to upload and execute arbitrary code and obtain sensitive information.
What is the severity of CVE-2023-38887?
The severity of CVE-2023-38887 is rated as high with a CVSS score of 8.8.
How can I fix CVE-2023-38887?
To fix CVE-2023-38887, it is recommended to update Dolibarr ERP CRM to version 17.0.1 or later, as this vulnerability has been patched in that release.
Where can I find more information about CVE-2023-38887?
More information about CVE-2023-38887 can be found on the Dolibarr website, AKERVA Security Advisory, and NIST's vulnerability database.