An issue in Dolibarr 16 before 16.0.5 allows unauthenticated attackers to perform a database dump and access a company's entire customer file, prospects, suppliers, and employee information if a contact file exists.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - An issue in Dolibarr 16 before 16.0.5 allows unauthenticated attackers to perform a database dump and     access a company's entire customer file, prospects, suppliers, and employee information if a contact file     exists. (CVE-2023-33568)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - An issue in Dolibarr 16 before 16.0.5 allows unauthenticated attackers to perform a database dump and
    access a company's entire customer file, prospects, suppliers, and employee information if a contact file
    exists. (CVE-2023-33568)

Dolibarr versions 16.x < 16.0.5 suffer from an improper access control vulnerability, allowing a remote and unauthenticated attacker to access the target instance contact database, including public and private notes.

ID	Name	Product	Family	Severity
262193	Linux Distros Unpatched Vulnerability : CVE-2023-33568	Nessus	Misc.	high
414626	SCA: security update for dolibarr/dolibarr (GHSA-fpvg-m786-h5vr)	Tenable Cloud Security	SCA Checks	high
414626	SCA: security update for dolibarr/dolibarr (GHSA-fpvg-m786-h5vr)	Tenable Self-Hosted Container Security	SCA Checks	high
114449	Dolibarr 16.x < 16.0.5 Database Download	Web App Scanning	Component Vulnerability	high

Detections

Analytics

CVE-2023-33568

high

Tenable Plugins

high

high

high

high