CVE-2024-31503

Incorrect access control in Dolibarr ERP CRM versions 19.0.0 and before, allows authenticated attackers to steal victim users' session cookies and CSRF…

High · published April 16, 2024

CVSS v3.1
7.5
EPSS
0%
Percentile
16.4
In the wild
Unconfirmed
What it is

Incorrect access control in Dolibarr ERP CRM versions 19.0.0 and before, allows authenticated attackers to steal victim users' session cookies and CSRF protection tokens via user interaction with a crafted web page, leading to account takeover.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:L
CVSS v4.0
Not supplied
EPSS
0.00257 · 16.4th percentile
Published
2024-04-16T00:00Z
EPSS history
Timeline
  • 16 APR 00:00Z
    Incorrect access control in Dolibarr ERP CRM versions 19.0.0 and before, allows authenticated attackers to steal victim users' session cookies and CSRF…
    cvelistv5