CVE-2020-7995 — Vulnerability in dolibarr/dolibarr — CVE Details
Dolibarr Improper Restriction of Excessive Authentication Attempts
Summary
Advisory Timeline
- First published May 24, 2022 (1602 days ago).
- Last revised April 3, 2025 — 1045 days after initial publication.
Affected Packages (1)
Affects 1 ecosystem: packagist (1).
| Package | Ecosystem | Affected | Fixed In |
|---|---|---|---|
| dolibarr/dolibarr | packagist | 10.0.6 | No fix available |
Vulnerability Classification
Common Weakness Enumeration (CWE) identifiers for this vulnerability type.
- CWE-287Improper AuthenticationMITRE
- CWE-307
CVSS Score Breakdown
What the CVSS (Common Vulnerability Scoring System) 9.8 score means for each attack dimension.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://nvd.nist.gov/vuln/detail/CVE-2020-7995ADVISORY
- https://github.com/Dolibarr/dolibarrPACKAGE
- https://github.com/tufangungor/tufangungor.github.io/blob/master/_posts/2020-01-19-dolibarr-10.0.6-brute-force.mdWEB
- https://tufangungor.github.io/exploit/2020/01/18/dolibarr-10.0.6-brute-force.htmlWEB
- https://packetstormsecurity.com/files/163541/Dolibarr-ERP-CRM-10.0.6-Login-Brute-Forcer.htmlWEB
Frequently Asked Questions
- What is CVE-2020-7995?
- Dolibarr Improper Restriction of Excessive Authentication Attempts This vulnerability has been assigned a severity rating of CRITICAL (CVSS score: 9.8/10).
- How do I check if my project is affected by CVE-2020-7995?
- CVE-2020-7995 affects dolibarr/dolibarr. Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2020-7995 and 200,000+ other known vulnerabilities.
Severity & Exploitability
Exploitation is straightforward and causes maximum impact. Patch immediately.
Also Known As
Related CVEs
- CVE-2018-13450CRITICAL
Dolibarr SQL injection vulnerability in product/card.php
- CVE-2023-38888CRITICAL
Cross Site Scripting vulnerability in Dolibarr ERP CRM
- CVE-2017-17900CRITICAL
Dolibarr SQL injection vulnerability in fourn/index.php
- CVE-2017-17899CRITICAL
Dolibarr SQL injection vulnerability in adherents/subscription/info.php
- CVE-2022-40871CRITICAL
Dolibarr vulnerable to Eval Injection
- CVE-2017-7888CRITICAL
Dolibarr ERP and CRM Insecure Encryption
- CVE-2025-56588HIGH
Dolibarr vulnerable to RCE via the computed field parameter
- CVE-2026-31018HIGH
Dolibarr Allows Code Injection through its Website Module
Check if you're affected
Scan your dependencies to see if this vulnerability affects your projects.
Scan Your Dependencies