Description
Dolibarr ERP CRM before 24.0.2 contains an incorrect authorization vulnerability in htdocs/core/ajax/updateextrafield.php that checks only read permission before writing extrafield values. Authenticated users with read-only access can POST objectType, objectId, field and value parameters to persistently modify extrafields on viewable third parties, products, members, projects or contacts.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Dolibarr | dolibarr | < 24.0.2 | 24.0.2 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 16.04 LTS | dolibarr | No fix yet | — |
References
- Patch Commit patch
- https://github.com/Dolibarr/dolibarr product
- https://github.com/Dolibarr/dolibarr/blob/24.0.1/htdocs/core/ajax/updateextrafield.php#L80 technical-description
- VulnCheck Advisory: Dolibarr before 24.0.2 Incorrect Authorization via updateextrafield.php third-party-advisory