CVE-2019-11201 Information

Description

Dolibarr ERP/CRM 9.0.1 provides a module named website that provides for creation of public websites with a WYSIWYG editor. It was identified that the editor also allowed inclusion of dynamic code which can lead to code execution on the host machine. An attacker has to check a setting on the same page which specifies the inclusion of dynamic content. Thus a lower privileged user of the application can execute code under the context and permissions of the underlying web server.

CVSS Vector

CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Reference

https://know.bishopfox.com/advisories/dolibarr-version-9-0-1-vulnerabilities

Attack Complexity

LOW

Privileges Required

LOW

User Interaction Required

LOW

Scope

REQUIRED

Confidentiality Impact

UNCHANGED

Integrity Impact

HIGH

Availability Impact

HIGH

Base Score

HIGH

Base Severity

8.0