GitHub Advisoryadvisory · Packagist

GHSA-hwmc-v6j6-gc2p Dolibarr Cross Site Request Forgery (CSRF)

HIGH Published 2022-05-24 Modified 2024-04-24 Official page ↗
Aliases
CVE-2019-1010054
Ecosystem
Packagist
Packages
dolibarr/dolibarr
Severity
High
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weaknesses
CWE-352
Reviewed
2024-04-24

Affected packages

• Packagist dolibarr/dolibarr: 7.0.0 (no fix yet)

Description

Dolibarr 7.0.0 is affected by: Cross Site Request Forgery (CSRF). The impact is: allow malitious html to change user password, disable users and disable password encryptation. The component is: Function User password change, user disable and password encryptation. The attack vector is: admin access malitious urls.

Related

Alias · CVE (1)

  • CVE-2019-1010054 Dolibarr 7.0.0 is affected by: Cross Site Request Forgery (CSRF). vulnerability

Weakness · CWE (1)

  • CWE-352 Cross-Site Request Forgery weakness

References