CVE-2020-35136: Command Injection

December 23, 2020 (updated July 21, 2021)

Dolibarr is vulnerable to authenticated Remote Code Execution. An attacker who has the access the admin dashboard can manipulate the backup function by inserting a payload into the filename for the zipfilename_template parameter to admin/tools/dolibarr_export.php.

References

nvd.nist.gov/vuln/detail/CVE-2020-35136

Detect and mitigate CVE-2020-35136 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →