high8.0
CVE-2018-10092
Dolibarr arbitrary commands execution
Impact
The admin panel in Dolibarr before 7.0.2 might allow remote attackers to execute arbitrary commands by leveraging support for updating the antivirus command and parameters used to scan file uploads.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| composer | dolibarr/dolibarr | < 7.0.2 | 7.0.2 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Dolibarr | Dolibarr | before 7.0.2 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- http://www.openwall.com/lists/oss-security/2018/05/21/2
- https://github.com/Dolibarr/dolibarr/blob/7.0.2/ChangeLog
- https://github.com/Dolibarr/dolibarr/commit/5d121b2d3ae2a95abebc9dc31e4782cbc61a1f39
- https://sysdream.com/news/lab/2018-05-21-cve-2018-10092-dolibarr-admin-panel-authenticated-remote-code-execution-rce-vulnerability/
- https://github.com/advisories/GHSA-6j62-m2vv-wc3m
- https://nvd.nist.gov/vuln/detail/CVE-2018-10092
- https://sysdream.com/news/lab/2018-05-21-cve-2018-10092-dolibarr-admin-panel-authenticated-remote-code-execution-rce-vulnerability