p PatchFirst

CVE-2021-33816

CVE-2021-33816

This page contains facts from public vulnerability sources. Check the original advisory before updating.

The website builder module in Dolibarr 13.0.2 allows remote PHP code execution because of an incomplete protection mechanism in which system, exec, and shell_exec are blocked but backticks are not blocked.

CVSS 9.8 · Critical · EPSS 3.9% · Fix available

Published
Updated

Stack: system · php

Affected products and versions

  • n/a

    Versions
    • n/a: Affected

    No fix published

  • dolibarr/dolibarr Packagist

    Versions
    • 13.0.2
    • 13.0.3
    • 13.0.4
    • 13.0.5
    Affected ranges
    • ECOSYSTEM: ≥ 13.0.2, < 14.0.0

    Update to 14.0.0

  • dolibarr Ubuntu:Pro:16.04:LTS

    Versions
    • 3.5.5+dfsg1-2
    • 3.5.7+dfsg1-1
    • 3.5.8+dfsg1-1
    • 3.5.8+dfsg1-1ubuntu1
    • 3.5.8+dfsg1-1ubuntu1+esm1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →