GitHub Advisoryadvisory · Packagist

GHSA-wppr-j57c-8jpm Improper Authorization in dolibarr/dolibarr

MEDIUM Published 2024-11-15 Modified 2024-11-15 Official page ↗
Aliases
CVE-2021-3991
Ecosystem
Packagist
Packages
dolibarr/dolibarr
Severity
Moderate
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Weaknesses
CWE-285, CWE-639
Reviewed
2024-11-15

Affected packages

• Packagist dolibarr/dolibarr: < 15.0.0 → fixed in 15.0.0

Description

An Improper Authorization vulnerability exists in Dolibarr versions prior to version 15.0.0. A user with restricted permissions in the 'Reception' section is able to access specific reception details via direct URL access, bypassing the intended permission restrictions.

Related

Alias · CVE (1)

  • CVE-2021-3991 An Improper Authorization vulnerability exists in Dolibarr versions prior to the 'develop' branch. vulnerability

Weakness · CWE (2)

  • CWE-285 Improper Authorization weakness
  • CWE-639 Authorization Bypass Through User-Controlled Key weakness

References