Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
6.5

Dolibarr CRM allows attackers to upload malicious files

CVE-2020-14201 · published 6 years ago
Summary

A vulnerability in Dolibarr CRM versions before 11.0.5 allows attackers who have already logged in to the system to upload files that they shouldn't be able to. This could lead to unauthorized changes to the system. To fix this, update to Dolibarr CRM version 11.0.5 or later.

What to do
  • Update dolibarr dolibarr to version 11.0.5.
Affected software
Ecosystem VendorProductAffected versions
composer dolibarr dolibarr < 11.0.5
Fix: upgrade to 11.0.5
Ubuntu:Pro:16.04:LTS canonical dolibarr All versions
Original advisory text
Dolibarr CRM before 11.0.5 allows privilege escalation. This could allow remote authenticated attackers to upload arbitrary files via societe/document.php in which "disabled" is changed to "enabled...
Dolibarr CRM before 11.0.5 allows privilege escalation. This could allow remote authenticated attackers to upload arbitrary files via societe/document.php in which "disabled" is changed to "enabled" in the HTML source code.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker partial control (estimated)
Severity
6.5 Medium
Exploitation
2% chance of attack within 30 days
Type
CWE-269Improper Privilege Management
Timeline
Published21 Aug 2020
Updated3 Nov 2026
First seen6 Mar 2026
Sources
GHSA-25h3-mw3p-w8r7 · GHSA
CVE-2020-14201 · NVD
UBUNTU-CVE-2020-14201 · OSV
Track software like this
Free during beta