Critical · 9.8 CVE-2021-33816 BIT-dolibarr-2021-33816EUVD-2022-5459GHSA-vxr9-p2xw-m8cf

Dolibarr remote PHP code execution

Published Nov 10, 2021 · Updated Aug 3, 2024 · Assigned by mitre

Package: dolibarr Package: dolibarr/dolibarr Ecosystem: Packagist Ecosystem: Ubuntu

Description

The website builder module in Dolibarr 13.0.2 allows remote PHP code execution because of an incomplete protection mechanism in which system, exec, and shell_exec are blocked but backticks are not blocked.

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Ubuntu

Security tracker ↗

Release	Package	Fixed in	Advisory
Ubuntu Pro 16.04 LTS	dolibarr	No fix yet	—

Affected packages

Ecosystem	Package	Affected	Fixed	Record
Packagist	dolibarr/dolibarr	>= 13.0.2, < 14.0.0	14.0.0	GHSA-vxr9-p2xw-m8cf

References

https://trovent.io/security-advisory-2106-01
https://trovent.github.io/security-advisories/TRSA-2106-01/TRSA-2106-01.txt
20211112 Trovent Security Advisory 2106-01 / CVE-2021-33816: Authenticated remote code execution in Dolibarr ERP & CRM mailing-list