Date: Wed, 17 May 2017 22:08:25 +0200 From: Stefan Pietsch <stefan.pietsch@...mole.com> To: <oss-security@...ts.openwall.com> CC: <fulldisclosure@...lists.org> Subject: Re: Dolibarr ERP & CRM - Multiple Issues On 10.05.2017 10:28, FOXMOLE Advisories wrote: > === FOXMOLE - Security Advisory 2017-02-23 === > > Dolibarr ERP & CRM - Multiple Issues > ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ > > Affected Versions > ================= > Dolibarr 4.0.4 > > Issue Overview > ============== > Vulnerability Type: SQL Injection, Cross Site Scripting, > Weak Hash Algorithm without Salt, Weak Password Change Method > Technical Risk: critical > Likelihood of Exploitation: medium > Vendor: Dolibarr > Vendor URL: https://www.dolibarr.org/ > Credits: FOXMOLE employees Tim Herres and Stefan Pietsch > Advisory URL: https://www.foxmole.com/advisories/foxmole-2017-02-23.txt > Advisory Status: Public > OVE-ID: OVE-20170223-0001 > CVE Number: CVE-2017-7886, CVE-2017-7887, CVE-2017-7888 > CVE URL: https://www.cve.mitre.org/cgi-bin/cvename.cgi?name=2017-7886 > https://www.cve.mitre.org/cgi-bin/cvename.cgi?name=2017-7887 > https://www.cve.mitre.org/cgi-bin/cvename.cgi?name=2017-7888 > CWE-ID: CWE-79, CWE-89, CWE-327, CWE-620, CWE-759 > CVSS 2.0: 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) --- snip --- Here is a small update to our security advisory. An additional CVE ID got assigned for the password change finding: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-8879 Meanwhile the Dolibarr developers fixed more possible SQL injection bugs in this git commit: https://github.com/Dolibarr/dolibarr/commit/fa290c34fad108ec7c0751c0372ae9c4b4f63b06 They still didn't release a fixed version of the Dolibarr software. For CVE-2017-7886 I don't agree with the CVSS v2 scoring from the NIST. They rated "Confidentiality Impact" as partial while I think it is complete as we have full access to all tables. Regards, Stefan Download attachment "signature.asc" of type "application/pgp-signature" (834 bytes)
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.