CVE-2021-25956CWE-284

Improper User Access Control in "Dolibarr" Leads to Account Takeover

Medium · published August 17, 2021

CVSS v3.1
4.7
EPSS
1%
Percentile
60.5
In the wild
Unconfirmed
What it is

In “Dolibarr” application, v3.3.beta1_20121221 to v13.0.2 have “Modify” access for admin level users to change other user’s details but fails to validate already existing “Login” name, while renaming the user “Login”. This leads to complete account takeover of the victim user. This happens since the password gets overwritten for the victim user having a similar login name.

The record
Technical detail
CVSS v3.1
4.7 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00935 · 60.5th percentile
Weakness
CWE-284 · Improper Access Control
Published
2021-08-17T14:15Z
EPSS history
Timeline
  • 17 AUG 14:15Z
    Improper User Access Control in "Dolibarr" Leads to Account Takeover
    cvelistv5