high7.2
CVE-2021-25956
Dolibarr vulnerable to Improper Authentication and Improper Access Control
Impact
In `Dolibarr` application, v3.3.beta1_20121221 to v13.0.2 have `Modify` access for admin level users to change other user’s details but fails to validate already existing “Login” name, while renaming the user `Login`. This leads to complete account takeover of the victim user. This happens since the password gets overwritten for the victim user having a similar login name.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| composer | dolibarr/dolibarr | >= 3.3.beta1, < 13.0.2 | 14.0.0 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Dolibarr | Dolibarr | from 3.3.1 through 13.0.2 |
| Dolibarr | Dolibarr Erp\/Crm | Version 3.3.0 |