Lucene search

MendCVELIST:CVE-2021-25954

HistoryAug 09, 2021 - 4:58 p.m.

CVE-2021-25954 Improper Access Control in “Dolibarr”

2021-08-0916:58:31

CWE-284

Mend

www.cve.org

cve-2021-25954

dolibarr

access control

unauthorized access

privileged attacker

administrator rights

endpoint

CVSS3

4.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

AI Score

4.7

Confidence

High

EPSS

0.001

Percentile

19.4%

JSON

In “Dolibarr” application, 2.8.1 to 13.0.4 don’t restrict or incorrectly restricts access to a resource from an unauthorized actor. A low privileged attacker can modify the Private Note which only an administrator has rights to do, the affected field is at “/adherents/note.php?id=1” endpoint.

CNA Affected

[
  {
    "product": "dolibarr",
    "vendor": "Dolibarr",
    "versions": [
      {
        "lessThan": "unspecified",
        "status": "affected",
        "version": "2.8.1",
        "versionType": "custom"
      },
      {
        "lessThanOrEqual": "13.0.4",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]

References

github.com/Dolibarr/dolibarr/commit/8cc100012d46282799fb19f735a53b7101569377

www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25954

CVSS3

4.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

AI Score

4.7

Confidence

High

EPSS

0.001

Percentile

19.4%

JSON

Related for CVELIST:CVE-2021-25954