Loading...
Skip to main content
GeekWala

CVE-2022-40871 — Vulnerability in dolibarr/dolibarr — CVE Details

CRITICAL

Dolibarr vulnerable to Eval Injection

Published October 12, 2022Updated May 15, 2025Source: osv

Summary

Dolibarr ERP & CRM <=15.0.3 are vulnerable to Eval injection. By default, any administrator can be added to the installation page of dolibarr, and if successfully added, malicious code can be inserted into the database and then execute it by eval.

Advisory Timeline

  • First published October 12, 2022 (1461 days ago).
  • Last revised May 15, 2025 — 946 days after initial publication.

Affected Packages (1)

Affects 1 ecosystem: packagist (1).

PackageEcosystemAffectedFixed In
dolibarr/dolibarr
packagist
10.0.0, 10.0.1, 10.0.2, 10.0.3 (+108 more)Range-based data available

Vulnerability Classification

Common Weakness Enumeration (CWE) identifiers for this vulnerability type.

CVSS Score Breakdown

What the CVSS (Common Vulnerability Scoring System) 9.8 score means for each attack dimension.

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

Frequently Asked Questions

What is CVE-2022-40871?
Dolibarr vulnerable to Eval Injection This vulnerability has been assigned a severity rating of CRITICAL (CVSS score: 9.8/10).
How do I check if my project is affected by CVE-2022-40871?
CVE-2022-40871 affects dolibarr/dolibarr. Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2022-40871 and 200,000+ other known vulnerabilities.

Severity & Exploitability

CVSS Score
9.8

Exploitation is straightforward and causes maximum impact. Patch immediately.

Also Known As

GHSA-7cm4-vmf2-8wf2
BIT-dolibarr-2022-40871

Related CVEs

Check if you're affected

Scan your dependencies to see if this vulnerability affects your projects.

Scan Your Dependencies