CVE-2024-29477 json
Dolibarr ERP CRM Code Injection vulnerability during installation
published 2024-04-03 2 y ago modified 2026-07-09 4 mo ago also BIT-dolibarr-2024-29477 , EUVD-2024-1264 , GHSA-p73x-rpgm-3v56
- cvss
- 8.8
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.8%
- EPSS 0.8% chance of exploitation in 30 days, percentile 57%
- public exploits
- 0
- none known
Summary
Lack of sanitization during Installation Process in Dolibarr ERP CRM up to version 19.0.0 allows an attacker with adjacent access to the network to execute arbitrary code via a specifically crafted input.
Patch / fix
- bitnami dolibarr 19.0.1
- dolibarr dolibarr_erp/crm 19.0.1
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 2 y ago
Exploit prediction
0.81% chance of exploitation in the next 30 days, higher than 57% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CISA ADP | 3.1 | 8.8 | CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| GitHub | 3.1 | 6.8 | CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H |
| NVD | 3.1 | 8.8 | CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| CNA | 3.1 | 8.8 | CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| OSV | 3.1 | 8.8 | CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| packagist | dolibarr/dolibarr | <=19.0.0 |
no fix listed |
| bitnami | dolibarr | <19.0.1 |
19.0.1 |
Classification
- Weakness
-
- CWE-94 Improper Control of Generation of Code
References
-
github.com
/alexbsec/CVEs/blob/master/2024/CVE-2024-29477.md
web, third-party-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2024-29477
advisory, web
-
github.com
/Dolibarr/dolibarr
package
-
dolibarr.com
web
Sources
- CVE List CVE-2024-29477
- GitHub Advisory GHSA-p73x-rpgm-3v56
- NVD CVE-2024-29477
- OSV BIT-dolibarr-2024-29477
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.