Dolibarr Erp Crm CVE-2022-0731

MEDIUM

Improper Access Control (CWE-284)

2022-02-23 security@huntr.dev

Authentication Bypass Dolibarr Erp Crm

6.5

CVSS 3.1 · NVD

Share

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

1

CVE Published

Feb 23, 2022 - 19:15 nvd

MEDIUM 6.5

DescriptionNVD

Improper Access Control (IDOR) in GitHub repository dolibarr/dolibarr prior to 16.0.

AnalysisAI

Improper Access Control (IDOR) in GitHub repository dolibarr/dolibarr prior to 16.0. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.

Technical ContextAI

This vulnerability is classified under CWE-284. Improper Access Control (IDOR) in GitHub repository dolibarr/dolibarr prior to 16.0. Affected products include: Dolibarr Dolibarr Erp\/Crm. Version information: prior to 16.0..

RemediationAI

A vendor patch is available. Apply the latest security update as soon as possible. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

More in Dolibarr Erp Crm

View all

CVE-2023-38886 HIGH Act Now POC

An issue in Dolibarr ERP CRM v.17.0.1 and before allows a remote privileged attacker to execute arbitrary code via a cra

CVE-2023-30253 HIGH Act Now POC

Dolibarr before 17.0.1 allows remote code execution by an authenticated user via an uppercase manipulation: <?PHP instea

CVE-2017-7886 CRITICAL Act Now POC

Dolibarr ERP/CRM 4.0.4 has SQL Injection in doli/theme/eldy/style.css.php via the lang parameter. Rated critical severit

CVE-2023-38888 CRITICAL Act Now POC

Cross Site Scripting vulnerability in Dolibarr ERP CRM v.17.0.1 and before allows a remote attacker to obtain sensitive

CVE-2017-7888 CRITICAL Act Now POC

Dolibarr ERP/CRM 4.0.4 stores passwords with the MD5 algorithm, which makes brute-force attacks easier. Rated critical s

CVE-2022-4093 CRITICAL Act Now POC

SQL injection attacks can result in unauthorized access to sensitive data, such as passwords, credit card details, or pe

CVE-2022-43138 CRITICAL Act Now POC

Dolibarr Open Source ERP & CRM for Business before v14.0.1 allows attackers to escalate privileges via a crafted API. Ra

CVE-2022-40871 CRITICAL Act Now POC

Dolibarr ERP & CRM <=15.0.3 is vulnerable to Eval injection. Rated critical severity (CVSS 9.8), this vulnerability is r

CVE-2021-33816 CRITICAL Act Now POC

The website builder module in Dolibarr 13.0.2 allows remote PHP code execution because of an incomplete protection mecha

CVE-2020-7995 CRITICAL Act Now POC

The htdocs/index.php?mainmenu=home login page in Dolibarr 10.0.6 allows an unlimited rate of failed authentication attem

CVE-2024-5315 CRITICAL Act Now POC

Vulnerabilities in Dolibarr ERP - CRM that affect version 9.0.1 and allow SQL injection. Rated critical severity (CVSS 9

CVE-2023-38887 HIGH This Week POC

File Upload vulnerability in Dolibarr ERP CRM v.17.0.1 and before allows a remote attacker to execute arbitrary code and

Same weakness CWE-284 – Improper Access Control

View all

CVE-2012-4681 CRITICAL POC

CVE-2011-3544 CRITICAL POC

CVE-2012-1723 CRITICAL POC

CVE-2012-5076 CRITICAL POC

CVE-2014-3120 HIGH POC

CVE-2013-2423 LOW POC

CVE-2016-3427 CRITICAL

CVE-2025-12480 CRITICAL POC

Same technique Authentication Bypass

View all

CVE-2023-22515 CRITICAL POC

CVE-2012-4681 CRITICAL POC

CVE-2013-2465 CRITICAL POC

CVE-2011-3544 CRITICAL POC

CVE-2012-1723 CRITICAL POC

CVE-2017-10271 HIGH POC

CVE-2015-1427 CRITICAL POC

CVE-2025-3248 CRITICAL POC

Share

CVE-2022-0731 vulnerability details – vuln.today

Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy