GHSA-c32w-3cqh-f6jx

ghsaUSosv

Weak Password Recovery Mechanism for Forgotten Password

view advisory published 2021-09-02Licence: CC-BY-4.0

In “Dolibarr” application, v2.8.1 to v13.0.2 are vulnerable to account takeover via password reset functionality. A low privileged attacker can reset the password of any user in the application using the password reset link the user received through email when requested for a forgotten password.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2021-25957US	high8.8	1.06% (64th)	—	2021-08-17
In “Dolibarr” application, v2.8.1 to v13.0.2 are vulnerable to account takeover via password reset functionality. A low privileged attacker can reset the password of any user in th…

references

External citations — patches, advisories, analysis.

https://github.com/Dolibarr/dolibarrPACKAGE
https://github.com/Dolibarr/dolibarr/commit/87f9530272925f0d651f59337a35661faeb6f377WEB
https://nvd.nist.gov/vuln/detail/CVE-2021-25957ADVISORY
https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25957WEB

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan