Lucene search

MitreCVE-2021-33816

HistoryNov 10, 2021 - 11:15 p.m.

CVE-2021-33816

2021-11-1023:15:08

CWE-94

mitre

web.nvd.nist.gov

nvd

cve-2021-33816

dolibarr

website builder

remote code execution

incomplete protection mechanism

php

backticks

CVSS2

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.7

Confidence

High

EPSS

0.019

Percentile

88.8%

JSON

The website builder module in Dolibarr 13.0.2 allows remote PHP code execution because of an incomplete protection mechanism in which system, exec, and shell_exec are blocked but backticks are not blocked.

Affected configurations

Nvd

Node

dolibarrdolibarr_erp\/crmMatch13.0.2

VendorProductVersionCPE
dolibarrdolibarr_erp\/crm13.0.2cpe:2.3:a:dolibarr:dolibarr_erp\/crm:13.0.2:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
dolibarr	dolibarr_erp\/crm	13.0.2	cpe:2.3:a:dolibarr:dolibarr_erp\/crm:13.0.2:::::::*

References

seclists.org/fulldisclosure/2021/Nov/39

trovent.github.io/security-advisories/TRSA-2106-01/TRSA-2106-01.txt

trovent.io/security-advisory-2106-01

CVSS2

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.7

Confidence

High

EPSS

0.019

Percentile

88.8%

JSON

Related for CVE-2021-33816