high8.8
CVE-2021-25957
In “Dolibarr” application, v2.8.1 to v13.0.2 are vulnerable to account takeover via password reset functionality.
Impact
In “Dolibarr” application, v2.8.1 to v13.0.2 are vulnerable to account takeover via password reset functionality. A low privileged attacker can reset the password of any user in the application using the password reset link the user received through email when requested for a forgotten password.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Dolibarr | Dolibarr | from 2.8.1 through 13.0.2 |
Weakness classification
References
- NVD record
- CVE.org record
- https://github.com/Dolibarr/dolibarr/commit/87f9530272925f0d651f59337a35661faeb6f377
- https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25957
- https://github.com/Dolibarr/dolibarr/commit/87f9530272925f0d651f59337a35661faeb6f377
- https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25957