CVE-2023-4198

MEDIUM

Dolibarr Erp/crm < 17.0.3 - Missing Authorization

Title source: rule

Improper Access Control in Dolibarr ERP CRM <= v17.0.3 allows an unauthorized authenticated user to read a database table containing customer data

Core 2

Core References

Exploit, Third Party Advisory third-party-advisory

Patch patch

CVSS v3 6.5

EPSS 0.0008

EPSS Percentile 23.3%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Vulnrichment

Exploitation poc

Automatable no

Technical Impact partial

CWE

CWE-862

Status published

Products (2)

dolibarr/dolibarr 0 - 18.0.0Packagist

dolibarr/dolibarr_erp\/crm < 17.0.3

Published Nov 01, 2023

Tracked Since Feb 18, 2026