System	Score	Found at
cvssv3	9.8	https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2018/UBUNTU-CVE-2018-10094.json
ubuntu-priority	medium	https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2018/UBUNTU-CVE-2018-10094.json

Reference id	Reference type	URL
		https://ubuntu.com/security/CVE-2018-10094
		https://www.cve.org/CVERecord?id=CVE-2018-10094

Data source	Metasploit
Description	This module enables an authenticated user to collect the usernames and encrypted passwords of other users in the Dolibarr ERP/CRM via SQL injection.
Note	Reliability: - unknown-reliability Stability: - unknown-stability SideEffects: - unknown-side-effects
Ransomware campaign use	Unknown
Source publication date	May 30, 2018
Source URL	https://github.com/rapid7/metasploit-framework/tree/master/modules/auxiliary/gather/dolibarr_creds_sqli.rb

Data source	Exploit-DB
Date added	May 30, 2018
Description	Dolibarr ERP/CRM 7.0.0 - (Authenticated) SQL Injection
Ransomware campaign use	Known
Source publication date	May 30, 2018
Exploit type	webapps
Platform	php
Source update date	July 13, 2018

No EPSS data available for this advisory.

Patch URL
There are no known patches.

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2018/UBUNTU-CVE-2018-10094.json

Attack Vector (AV)	Attack Complexity (AC)	Privileges Required (PR)	User Interaction (UI)	Scope (S)	Confidentiality Impact (C)	Integrity Impact (I)	Availability Impact (A)
network adjacent_network local physical	low high	none low high	none required	unchanged changed	high low none	high low none	high low none

There are no SSVC decisions available.