CVE-2020-14201: 
PHP vulnerability analysis and mitigation

A privilege escalation vulnerability was discovered in Dolibarr CRM version 11.0.4 and prior versions (CVE-2020-14201). The vulnerability was identified on June 12, 2020, and publicly disclosed on August 21, 2020. The issue affects the Dolibarr ERP/CRM system, which is an open source software package designed for small and medium companies, foundations, and freelancers (Wizlynx Advisory).

The vulnerability has a CVSS Base Score of 4.3 (Medium) and is classified under CWE-269. The attack vector is Network-based with low attack complexity and requires low privileges. The vulnerability allows authenticated users with Read access to any element of the application that permits file storage (such as Third Party, Proposal, etc.) to upload arbitrary files, bypassing intended access restrictions (Wizlynx Advisory).

The vulnerability impacts the integrity of the system with Low severity, while having no direct impact on confidentiality or availability. The successful exploitation could allow attackers to upload arbitrary files to elements they have read access to, potentially leading to unauthorized file manipulation (Wizlynx Advisory).

The vulnerability requires an authenticated user with read access to exploit. No user interaction is required beyond the attacker's actions, and the attack complexity is considered low. The scope remains unchanged during exploitation (Wizlynx Advisory).

The vulnerability was fixed in Dolibarr version 11.0.5. Users are advised to upgrade to this version or later to address the security issue (Wizlynx Advisory).