8.0high
CVE-2018-10092
Dolibarr arbitrary commands execution
Also known as GHSA-6j62-m2vv-wc3m
Published 8 y ago · modified 4 mo ago · JSON
CVSS
8.0
v3.0 · NVD
CISA KEV
No
not known exploited
EPSS
2.0%
percentile 81%
Public exploits
0
none known
Summary
The admin panel in Dolibarr before 7.0.2 might allow remote attackers to execute arbitrary commands by leveraging support for updating the antivirus command and parameters used to scan file uploads.
Exploit prediction (EPSS)
1.97% probability of exploitation in the next 30 days, higher than 81% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| NVD | 3.0 | 8.0 | CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 6.0 | AV:N/AC:M/Au:S/C:P/I:P/A:P |
| GitHub | 3.0 | 8.0 | CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H |
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| packagist | dolibarr/dolibarr | <7.0.2 | 7.0.2 |
Classification
- Weakness
- CWE-862 Missing Authorization
References
- github.com /Dolibarr/dolibarr/commit/5d121b2d3ae2a95abebc9dc31e4782cbc61a1f39 · x_refsource_CONFIRM, x_transferred
- github.com /Dolibarr/dolibarr/blob/7.0.2/ChangeLog · x_refsource_CONFIRM, x_transferred
- sysdream.com /news/lab/2018-05-21-cve-2018-10092-dolibarr-admin-panel-authenticated-remote-code-executi · x_refsource_MISC, x_transferred
- openwall.com /lists/oss-security/2018/05/21/2 · mailing-list, x_refsource_MLIST, x_transferred
- nvd.nist.gov /vuln/detail/CVE-2018-10092 · advisory
- github.com /Dolibarr/dolibarr · package
- sysdream.com /news/lab/2018-05-21-cve-2018-10092-dolibarr-admin-panel-authenticated-remote-code-executi · web
Sources
- CVE List: CVE-2018-10092
- GitHub Advisory: GHSA-6j62-m2vv-wc3m
- NVD: CVE-2018-10092
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.