Critical · 9.8 CVE-2020-7995 BIT-dolibarr-2020-7995EUVD-2022-4493GHSA-m5c3-3gvf-q8j5

Dolibarr Improper Restriction of Excessive Authentication Attempts

Published Jan 26, 2020 · Updated Aug 4, 2024 · Assigned by mitre

Package: dolibarr Package: dolibarr/dolibarr Ecosystem: Packagist Ecosystem: Ubuntu

Description

The htdocs/index.php?mainmenu=home login page in Dolibarr 10.0.6 allows an unlimited rate of failed authentication attempts.

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Ubuntu

Security tracker ↗

Release	Package	Fixed in	Advisory
Ubuntu Pro 16.04 LTS	dolibarr	No fix yet	—

Affected packages

Ecosystem	Package	Affected	Fixed	Record
Packagist	dolibarr/dolibarr	10.0.6	—	GHSA-m5c3-3gvf-q8j5

References

https://tufangungor.github.io/exploit/2020/01/18/dolibarr-10.0.6-brute-force.html
https://github.com/tufangungor/tufangungor.github.io/blob/master/_posts/2020-01-19-dolibarr-10.0.6-brute-force.md
http://packetstormsecurity.com/files/163541/Dolibarr-ERP-CRM-10.0.6-Login-Brute-Forcer.html