CVE-2017-14240
HighSummary
There is a sensitive information disclosure vulnerability in document.php in Dolibarr ERP/CRM version 6.0.0 via the file parameter.
Risk Assessment
Disclosure of sensitive information may lead to privacy breaches and potential financial losses for the organization.
Recommendation
It is recommended to upgrade to a newer version of Dolibarr ERP/CRM to mitigate this vulnerability and restrict access to the document.php file.
Other vulnerabilities in Dolibarr ERP/CRM version 6.0.0
See all- CVE-2017-17900Critical
Version 6.0.4 of Dolibarr ERP/CRM contains an SQL injection vulnerability in fourn/index.php that allows remote attackers to execute arbitrary SQL commands via the socid parameter.
- CVE-2017-17899Critical
An SQL injection vulnerability in Dolibarr ERP/CRM version 6.0.4 in adherents/subscription/info.php allows remote attackers to execute arbitrary SQL commands via the rowid parameter.
- CVE-2017-17897Critical
SQL injection vulnerability in comm/multiprix.php in Dolibarr ERP/CRM version 6.0.4 allows remote attackers to execute arbitrary SQL commands via the id parameter.
- CVE-2017-14238Critical
SQL injection vulnerability in admin/menus/edit.php in Dolibarr ERP/CRM version 6.0.0 allows remote attackers to execute arbitrary SQL commands via the menuId parameter.
Original NVD description (English source)
There is a sensitive information disclosure vulnerability in document.php in Dolibarr ERP/CRM version 6.0.0 via the file parameter.