GHSA-c32w-3cqh-f6jx

    Dashboard / Vulnerabilities / GHSA-c32w-3cqh-f6jx

    GHSA-c32w-3cqh-f6jx

    Published: 2 Sept 2021Last Modified: 8 Nov 2023

    Summary: Weak Password Recovery Mechanism for Forgotten Password

    Details: In “Dolibarr” application, v2.8.1 to v13.0.2 are vulnerable to account takeover via password reset functionality. A low privileged attacker can reset the password of any user in the application using the password reset link the user received through email when requested for a forgotten password.

    References: https://nvd.nist.gov/vuln/detail/CVE-2021-25957, https://github.com/Dolibarr/dolibarr/commit/87f9530272925f0d651f59337a35661faeb6f377, https://github.com/Dolibarr/dolibarr, https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25957

    Affected packages

    Package

    Name: dolibarr/dolibarr

    Purl: pkg:composer/dolibarr/dolibarr

    Affected ranges

    Type: ECOSYSTEM

    Events:

    Introduced- 0
    Fixed -14.0.0

    Affected versions

    10.0.0
    10.0.1
    10.0.2
    10.0.3
    10.0.4
    10.0.5
    10.0.6
    10.0.7

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    GHSA-c32w-3cqh-f6jx | CVE-DB