Lucene search

Veracode Vulnerability DatabaseVERACODE:47632

HistoryJun 19, 2024 - 6:36 a.m.

Arbitrary Code Execution

2024-06-1906:36:47

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

arbitrary code execution

validation

file upload

sql file

security flaw

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

7.7 High

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

9.2%

JSON

dolibarr/dolibarr is vulnerable to Arbitrary Code Execution. The vulnerability is due to improper validation of file types in the Upload Template function, allowing attackers to execute arbitrary code via uploading a crafted .SQL file.

CPENameOperatorVersion
dolibarr/dolibarrle15.0.3
dolibarr/dolibarrle15.0.3

CPE	Name	Operator	Version
	dolibarr/dolibarr	le	15.0.3
	dolibarr/dolibarr	le	15.0.3

References

dolibarr.com

github.com/advisories/GHSA-p7r8-7w87-8g46

github.com/alexbsec/CVEs/blob/master/2024/CVE-2024-37821.md

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

7.7 High

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

9.2%

JSON

Related for VERACODE:47632