What is GHSA-fjqg-w8g6-hhq8?

GHSA-fjqg-w8g6-hhq8 is a security advisory published by GitHub Security Advisories with High severity. Dolibarr vulnerable to Improper Authentication and Improper Access Control

Which CVE IDs does GHSA-fjqg-w8g6-hhq8 cover?

GHSA-fjqg-w8g6-hhq8 covers the following CVE IDs: CVE-2021-25956. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-fjqg-w8g6-hhq8?

GHSA-fjqg-w8g6-hhq8 has a CVSS v3 base score of 7.2, published by GitHub Security Advisories.

Which products are affected by GHSA-fjqg-w8g6-hhq8?

GHSA-fjqg-w8g6-hhq8 affects 1 product, including: composer/dolibarr/dolibarr:\u003e= 3.3.beta1, \u003c 13.0.2.

GHSA-fjqg-w8g6-hhq8HighCVSS 7.2

Dolibarr vulnerable to Improper Authentication and Improper Access Control

Vendor

GitHub Security Advisories

Published

September 2, 2021

Last Modified

January 29, 2023

🔗 CVE IDs covered (1)

CVE-2021-25956 →

📋 Description

In Dolibarr application, v3.3.beta1_20121221 to v13.0.2 have Modify access for admin level users to change other user’s details but fails to validate already existing “Login” name, while renaming the user Login. This leads to complete account takeover of the victim user. This happens since the password gets overwritten for the victim user having a similar login name.

🎯 Affected products1

composer/dolibarr/dolibarr:>= 3.3.beta1, < 13.0.2

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2021-25956
https://github.com/Dolibarr/dolibarr/commit/c4cba43bade736ab89e31013a6ccee59a6e077ee
https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25956
https://github.com/advisories/GHSA-fjqg-w8g6-hhq8