Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2021-25956

In “Dolibarr” application, v3.3.beta1_20121221 to v13.0.2 have “Modify” access for admin level users to change other user’s details but fails to validate already existing “Login” name, while renaming the user “Login”. This leads to complete account takeover of the victim user. This happens since the password gets overwritten for the victim user having a similar login name.

Published

2021-08-17T15:15:07.823

Last Modified

2024-11-21T05:55:40.273

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 4.7 (MEDIUM)

CVSSv2 Vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Access Vector: NETWORK
Access Complexity: LOW
Authentication: SINGLE
Confidentiality Impact: PARTIAL
Integrity Impact: PARTIAL
Availability Impact: PARTIAL

Exploitability Score

8.0

Impact Score

6.4

Weaknesses

Type: Secondary
CWE-284
Type: Primary
NVD-CWE-Other

Affected Vendors & Products

Type	Vendor	Product	Version/Range	Vulnerable?
Application	dolibarr	dolibarr	≤ 13.0.2	Yes
Application	dolibarr	dolibarr_erp\/crm	3.3.0	Yes
Application	dolibarr	dolibarr_erp\/crm	3.3.0	Yes

References

https://github.com/Dolibarr/dolibarr/commit/c4cba43bade736ab89e31013a6ccee59a6e077ee Patch, Third Party Advisory ([email protected])
https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25956 Third Party Advisory ([email protected])
https://github.com/Dolibarr/dolibarr/commit/c4cba43bade736ab89e31013a6ccee59a6e077ee Patch, Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25956 Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)