CVE-2021-25956

Опубликовано: 17 авг. 2021

Источник: nvd

CVSS3: 4.7

CVSS3: 7.2

CVSS2: 6.5

EPSS Низкий

Описание

In “Dolibarr” application, v3.3.beta1_20121221 to v13.0.2 have “Modify” access for admin level users to change other user’s details but fails to validate already existing “Login” name, while renaming the user “Login”. This leads to complete account takeover of the victim user. This happens since the password gets overwritten for the victim user having a similar login name.

Ссылки

https://github.com/Dolibarr/dolibarr/commit/c4cba43bade736ab89e31013a6ccee59a6e077ee
Patch
Third Party Advisory
https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25956
Third Party Advisory
https://github.com/Dolibarr/dolibarr/commit/c4cba43bade736ab89e31013a6ccee59a6e077ee
Patch
Third Party Advisory
https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25956
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:dolibarr:dolibarr:*:*:*:*:*:*:*:*

Версия от 3.3.1 (включая) до 13.0.2 (включая)

cpe:2.3:a:dolibarr:dolibarr_erp\/crm:3.3.0:beta1:*:*:*:*:*:*

cpe:2.3:a:dolibarr:dolibarr_erp\/crm:3.3.0:beta2:*:*:*:*:*:*

EPSS

Процентиль: 58%

0.00372

Низкий

4.7 Medium

CVSS3

7.2 High

CVSS3

6.5 Medium

CVSS2

Дефекты

CWE-284

NVD-CWE-Other

Связанные уязвимости

CVE-2021-25956

CVSS3: 4.7

ubuntu

больше 4 лет назад

CVE-2021-25956

CVSS3: 4.7

debian

больше 4 лет назад

In \u201cDolibarr\u201d application, v3.3.beta1_20121221 to v13.0.2 ha ...

GHSA-fjqg-w8g6-hhq8

CVSS3: 7.2

github

больше 4 лет назад

Dolibarr vulnerable to Improper Authentication and Improper Access Control

EPSS

Процентиль: 58%

0.00372

Низкий

4.7 Medium

CVSS3

7.2 High

CVSS3

6.5 Medium

CVSS2

Дефекты

CWE-284

NVD-CWE-Other