GitHub Advisoryadvisory · Packagist

GHSA-6ppg-rgrg-f573 Dolibarr vulnerable to Cross-Site Request Forgery

HIGH Published 2024-04-17 Modified 2024-08-20 Official page ↗
Aliases
CVE-2024-31503
Ecosystem
Packagist
Packages
dolibarr/dolibarr
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:L
Weaknesses
CWE-284, CWE-352
Reviewed
2024-04-17

Affected packages

• Packagist dolibarr/dolibarr: <= 19.0.0 (no fix yet)

Description

Incorrect access control in Dolibarr ERP CRM versions 19.0.0 and before, allows authenticated attackers to steal victim users' session cookies and CSRF protection tokens via user interaction with a crafted web page, leading to account takeover.

Related

Alias · CVE (1)

  • CVE-2024-31503 Incorrect access control in Dolibarr ERP CRM versions 19.0.0 and before, allows authenticated attackers to steal victim users' session… vulnerability

Weakness · CWE (2)

  • CWE-284 Improper Access Control weakness
  • CWE-352 Cross-Site Request Forgery weakness

References