{"id":"CVE-2023-4198","published":"2023-11-01T08:01:16Z","modified":"2024-09-05T19:56:33Z","title":"Dolibarr ERP CRM (<= 17.0.3) Improper Access Control","vendor":"Dolibarr","product":"Dolibarr ERP CRM","tier":"tail","description":{"text":"Improper Access Control in Dolibarr ERP CRM <= v17.0.3 allows an unauthorized authenticated user to read a database table containing customer data","provenance":"source","from":"CVE.org"},"cvss":{"score":6.5,"severity":"MEDIUM","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.00555,"percentile":0.46276,"provenance":"source"},"cwes":[{"id":"CWE-862","name":"Missing Authorization"}],"references":[{"url":"https://starlabs.sg/advisories/23/23-4198","tags":["third-party-advisory"]},{"url":"https://github.com/Dolibarr/dolibarr/commit/3065b9ca6ade988e8d7a8a8550415c0abb56b9cb#diff-7d68365a708c954051853ade884c7e97c6ff13150ee92657d6ffc8603e0f947b","tags":["patch"]}],"priority":{"score":13.8,"factors":[{"name":"EPSS percentile","points":9.26},{"name":"CVSS severity","points":4.55}]},"vendorSlug":"dolibarr","affectedVersions":[{"vendor":"Dolibarr","product":"Dolibarr ERP CRM","versions":["<= 17.0.3"]}],"affected":[{"ecosystem":"Packagist","package":"dolibarr/dolibarr","vulnerableRanges":["<18.0.0"],"patched":["18.0.0"],"from":["GHSA-48v2-596x-4jr9"],"provenance":"source"}],"euvd":{"id":"EUVD-2023-2873","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-dolibarr-dolibarr-cve-2019-16197","parents":[{"from":"CVE-2022-0819","to":"CVE-2023-4198","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["htdocs/core/class/html.form.class.php","htdocs/core/lib/functions.lib.php"],"commits":["https://github.com/dolibarr/dolibarr/commit/2a48dd349e7de0d4a38e448b0d2ecbe25e968075","https://github.com/Dolibarr/dolibarr/commit/3065b9ca6ade988e8d7a8a8550415c0abb56b9cb"],"basis":"rarely changed file"}]}],"packageHistory":[{"cve":"CVE-2023-38886","published":"2023-09-20","fixed":"17.0.1","kev":false},{"cve":"CVE-2023-38887","published":"2023-09-20","fixed":"17.0.1","kev":false},{"cve":"CVE-2023-38888","published":"2023-09-20","fixed":"17.0.1","kev":false},{"cve":"CVE-2023-4198","published":"2023-11-01","fixed":"18.0.0","kev":false},{"cve":"CVE-2023-5323","published":"2023-10-01","fixed":"18.0.0","kev":false},{"cve":"CVE-2023-4197","published":"2023-11-01","fixed":"18.0.2","kev":false,"link":{"from":"CVE-2023-4198","to":"CVE-2023-4197","relation":"successor","confidence":"low","kind":"sequence","orderedBy":"description","evidence":[{"kind":"version-step","provenance":"source","package":"Packagist:dolibarr/dolibarr","fromFixed":"18.0.0","toFixed":"18.0.2","daysApart":0}]}},{"cve":"CVE-2024-23817","published":"2024-01-25","fixed":"18.0.7","kev":false}],"package":"Packagist:dolibarr/dolibarr"}}