GitHub Advisoryadvisory · Packagist

GHSA-xw7v-qrhc-jjg2 Access Control vulnerability in Dolibarr

HIGH Published 2022-04-01 Modified 2022-04-18 Official page ↗
Aliases
CVE-2021-37517
Ecosystem
Packagist
Packages
dolibarr/dolibarr
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-863
Reviewed
2022-04-01

Affected packages

• Packagist dolibarr/dolibarr: < 14.0.1 → fixed in 14.0.1

Description

An Access Control vulnerability exists in Dolibarr ERP/CRM 13.0.2, fixed version is 14.0.1, in the forgot-password function becuase the application allows email addresses as usernames, which can cause a Denial of Service.

Related

Alias · CVE (1)

  • CVE-2021-37517 An Access Control vulnerability exists in Dolibarr ERP/CRM 13.0.2, fixed version is 14.0.0,in the forgot-password function becuase the… vulnerability

Weakness · CWE (1)

  • CWE-863 Incorrect Authorization weakness

References