CVE-2024-40137 Dolibarr ERP CRM vulnerable to remote code execution (RCE)
Attackers can execute arbitrary code remotely via the Computed field parameter in the Users Module Setup function of Dolibarr ERP CRM.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-40137?
CVE-2024-40137 is a medium-severity code injection vulnerability in n/a, published on 24 Jul 2024. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Dolibarr ERP CRM before 19.0.2-php8.2 was discovered to contain a remote code execution (RCE) vulnerability via the Computed field parameter under the Users Module Setup function.
Weakness: CWE-74
Which versions are affected by CVE-2024-40137?
2 open source packages ship an affected version, including dolibarr/dolibarr.
| Package | Affected | Fixed in |
|---|---|---|
dolibarr/dolibarr Packagist | All versions | 19.0.2 |
dolibarr/dolibarr Packagist | All versions | 19.0.2 |
How do I fix CVE-2024-40137?
Upgrade dolibarr/dolibarr to 19.0.2 or later.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2024-40137 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-40137 exists.
Sources
Also known as GHSA-vprp-94p9-5jp8, UBUNTU-CVE-2024-40137.