GitHub Advisoryadvisory · Packagist

GHSA-c32w-3cqh-f6jx Weak Password Recovery Mechanism for Forgotten Password

HIGH Published 2021-09-02 Modified 2021-10-21 Official page ↗
Aliases
CVE-2021-25957
Ecosystem
Packagist
Packages
dolibarr/dolibarr
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-640
Reviewed
2021-08-19

Affected packages

• Packagist dolibarr/dolibarr: < 14.0.0 → fixed in 14.0.0

Description

In “Dolibarr” application, v2.8.1 to v13.0.2 are vulnerable to account takeover via password reset functionality. A low privileged attacker can reset the password of any user in the application using the password reset link the user received through email when requested for a forgotten password.

Related

Alias · CVE (1)

  • CVE-2021-25957 In “Dolibarr” application, v2.8.1 to v13.0.2 are vulnerable to account takeover via password reset functionality. vulnerability

Weakness · CWE (1)

  • CWE-640 Weak Password Recovery Mechanism for Forgotten Password weakness

References