Description
Dolibarr ERP CRM before 24.0.2 contains a missing authorization vulnerability in htdocs/public/recruitment/view.php that allows unauthenticated attackers to view unpublished draft job positions. Attackers can enumerate sequential provisional references via the ref parameter to read titles, descriptions, salary budgets, and recruiter names and emails.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Dolibarr | Dolibarr ERP/CRM | < 24.0.2 | 24.0.2 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 16.04 LTS | dolibarr | No fix yet | — |
References
- Pull Request #41108 issue-tracking patch
- Patch Commit patch
- https://github.com/Dolibarr/dolibarr product
- https://github.com/Dolibarr/dolibarr/blob/24.0.1/htdocs/public/recruitment/view.php#L106 technical-description
- VulnCheck Advisory: Dolibarr ERP CRM before 24.0.2 Missing Authorization via public recruitment view.php third-party-advisory