GHSA-m66x-wm27-xxpc

ghsaUSosv

Dolibarr Cross-Site Request Forgery Vulnerability

view advisory published 2022-05-24Licence: CC-BY-4.0

In Dolibarr 10.0.6, forms are protected with a Cross-Site Request Forgery (CSRF) token against CSRF attacks. The problem is any CSRF token in any user's session can be used in another user's session. CSRF tokens should not be valid in this situation.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2020-11825US	high8.8	1.01% (63rd)	—	2020-04-16
In Dolibarr 10.0.6, forms are protected with a CSRF token against CSRF attacks. The problem is any CSRF token in any user's session can be used in another user's session. CSRF toke…

references

External citations — patches, advisories, analysis.

https://fatihhcelik.blogspot.com/2020/04/dolibarr-csrf.htmlWEB
https://github.com/Dolibarr/dolibarrPACKAGE
https://nvd.nist.gov/vuln/detail/CVE-2020-11825ADVISORY

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan