← Voltar para CVEs

CVE-2021-25956

MEDIUM

4.7

Descricao

In “Dolibarr” application, v3.3.beta1_20121221 to v13.0.2 have “Modify” access for admin level users to change other user’s details but fails to validate already existing “Login” name, while renaming the user “Login”. This leads to complete account takeover of the victim user. This happens since the password gets overwritten for the victim user having a similar login name.

Detalhes CVE

Pontuacao CVSS v3.14.7

SeveridadeMEDIUM

Vetor CVSSCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L

Vetor de ataqueNETWORK

ComplexidadeLOW

Privilegios necessariosHIGH

Interacao do usuarioNONE

Publicado8/17/2021

Ultima modificacao11/21/2024

Fontenvd

Avistamentos honeypot0

Produtos afetados

dolibarr:dolibarrdolibarr:dolibarr_erp\/crm

Fraquezas (CWE)

CWE-284

Referencias

https://github.com/Dolibarr/dolibarr/commit/c4cba43bade736ab89e31013a6ccee59a6e077ee(vulnerabilitylab@mend.io)

https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25956(vulnerabilitylab@mend.io)

https://github.com/Dolibarr/dolibarr/commit/c4cba43bade736ab89e31013a6ccee59a6e077ee(af854a3a-2127-422b-91ae-364da2661108)

https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25956(af854a3a-2127-422b-91ae-364da2661108)

Correlacoes IOC

Sem correlacoes registradas

This product uses data from the NVD API but is not endorsed or certified by the NVD.