GitHub Advisoryadvisory · Packagist

GHSA-m66x-wm27-xxpc Dolibarr Cross-Site Request Forgery Vulnerability

HIGH Published 2022-05-24 Modified 2023-07-17 Official page ↗
Aliases
CVE-2020-11825
Ecosystem
Packagist
Packages
dolibarr/dolibarr
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weaknesses
CWE-352
Reviewed
2023-07-17

Affected packages

• Packagist dolibarr/dolibarr: <= 10.0.6 (no fix yet)

Description

In Dolibarr 10.0.6, forms are protected with a Cross-Site Request Forgery (CSRF) token against CSRF attacks. The problem is any CSRF token in any user's session can be used in another user's session. CSRF tokens should not be valid in this situation.

Related

Alias · CVE (1)

  • CVE-2020-11825 In Dolibarr 10.0.6, forms are protected with a CSRF token against CSRF attacks. vulnerability

Weakness · CWE (1)

  • CWE-352 Cross-Site Request Forgery weakness

References