Dolibarr sensitive information disclosure

HOCH 7.5CVE-2017-17898 · GHSA-jm38-vmgp-j7rx · Published 27/12/2017 · updated 17/06/2026

Kurz gesagt

CVE-2017-17898 ist eine Schwachstelle (HOCH (CVSS 7.5)) in dolibarr/dolibarr, dolibarr erp/crm (dolibarr).
Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 2.1%, höher als bei 81.8% aller Schwachstellen.
Abhilfe: auf 6.0.5 oder neuer aktualisieren.

Package	Affected versions	Patched versions
dolibarr/dolibarr Packagist	`< 6.0.5`	`6.0.5`
dolibarr erp/crm dolibarr	`= 6.0.4`	No fix yet

Dolibarr ERP/CRM version 6.0.4 does not block direct requests to *.tpl.php files, which allows remote attackers to obtain sensitive information.

NVD description

Dolibarr ERP/CRM version 6.0.4 does not block direct requests to *.tpl.php files, which allows remote attackers to obtain sensitive information.

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Package

Affected versions

Patched versions

Packagist

< 6.0.5

6.0.5

= 6.0.4

No fix yet

Description

Dolibarr ERP/CRM version 6.0.4 does not block direct requests to *.tpl.php files, which allows remote attackers to obtain sensitive information.

NVD description

Dolibarr ERP/CRM version 6.0.4 does not block direct requests to *.tpl.php files, which allows remote attackers to obtain sensitive information.

Weitere Schwachstellen in dolibarr/dolibarr

Alle anzeigen →