Dolibarr ERP CRM Improper Authorization Vulnerability in Legacy Filemanager Component

An improper authorization vulnerability has been identified in Dolibarr ERP CRM versions prior to 23.0.2. The issue resides in an unknown function within the file 'htdocs/core/filemanagerdol/connectors/php/config.inc.php', part of the Legacy Filemanager component. This vulnerability allows remote exploitation, as the affected function can be accessed without proper authorization. The exploit is publicly available.

Impact

Exploitation of this vulnerability could lead to unauthorized access or actions within the application, potentially allowing an attacker to manipulate files or data through the compromised filemanager component.

Remediation

Users can upgrade to Dolibarr ERP CRM version 23.0.3 to address this vulnerability. The patch has been applied in this version.