Vulnerability · Published Aug 17, 2021 · Assigned by Mend
CVE-2021-25956Improper User Access Control in "Dolibarr" Leads to Account Takeover
Medium 4.7
In plain English
A medium-severity improper access control in dolibarr from Dolibarr. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 61% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
In “Dolibarr” application, v3.3.beta1_20121221 to v13.0.2 have “Modify” access for admin level users to change other user’s details but fails to validate already existing “Login” name, while renaming the user “Login”. This leads to complete account takeover of the victim user. This happens since the password gets overwritten for the victim user having a similar login name.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Packagist | dolibarr/dolibarr | 14.0.0 | GHSA-fjqg-w8g6-hhq8 |
Affected products (as reported)
Weakness: CWE-284 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L