Improper control of interaction frequency in dolibarr - CVE-2020-7995

Vulnerability details

The vulnerability allows a remote attacker to perform a brute-force attack.

The vulnerability exists due to the affected software lacks brute force protection in the "htdocs/index.php?mainmenu=home" login page. A remote attacker can launch a brute-force authentication attack in order to gain access to the system.

Affected software

How to mitigate CVE-2020-7995

Links to Public Exploits and PoC-codes

• Exploit #7073 - Dolibarr ERP/CRM 10.0.6 - Login Brute Force (November 25, 2021)
• Exploit #6543 - Exploit (My exploit for some cve) (July 19, 2021)

External References

• https://github.com/tufangungor/tufangungor.github.io/blob/master/_posts/2020-01-19-dolibarr-10.0.6-brute-force.md
• https://tufangungor.github.io/exploit/2020/01/18/dolibarr-10.0.6-brute-force.html

Related Security Bulletins

• Multiple vulnerabilities in Dolibarr