GitHub Advisoryadvisory · Packagist

GHSA-vxhc-c4qm-647p Improper Access Control in Dolibarr

MEDIUM Published 2021-08-11 Modified 2021-10-21 Official page ↗
Aliases
CVE-2021-25954
Ecosystem
Packagist
Packages
dolibarr/dolibarr
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Weaknesses
CWE-284, CWE-863
Reviewed
2021-08-10

Affected packages

• Packagist dolibarr/dolibarr: >= 2.8.1, < 14.0.0 → fixed in 14.0.0

Description

In “Dolibarr” application, 2.8.1 to 13.0.4 don’t restrict or incorrectly restricts access to a resource from an unauthorized actor. A low privileged attacker can modify the Private Note which only an administrator has rights to do, the affected field is at “/adherents/note.php?id=1” endpoint.

Related

Alias · CVE (1)

  • CVE-2021-25954 In “Dolibarr” application, 2.8.1 to 13.0.4 don’t restrict or incorrectly restricts access to a resource from an unauthorized actor. vulnerability

Weakness · CWE (2)

  • CWE-284 Improper Access Control weakness
  • CWE-863 Incorrect Authorization weakness

References