GHSA-fjqg-w8g6-hhq8

Suggest an improvement
Source
https://github.com/advisories/GHSA-fjqg-w8g6-hhq8
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/09/GHSA-fjqg-w8g6-hhq8/GHSA-fjqg-w8g6-hhq8.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-fjqg-w8g6-hhq8
Aliases
Published
2021-09-02T17:16:28Z
Modified
2023-11-08T04:05:18.631127Z
Severity
  • 7.2 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
Dolibarr vulnerable to Improper Authentication and Improper Access Control
Details

In Dolibarr application, v3.3.beta1_20121221 to v13.0.2 have Modify access for admin level users to change other user’s details but fails to validate already existing “Login” name, while renaming the user Login. This leads to complete account takeover of the victim user. This happens since the password gets overwritten for the victim user having a similar login name.

Database specific 
{
    "nvd_published_at": "2021-08-17T15:15:00Z",
    "github_reviewed_at": "2021-08-26T15:30:25Z",
    "severity": "HIGH",
    "github_reviewed": true,
    "cwe_ids": [
        "CWE-284",
        "CWE-287"
    ]
}
References

Affected packages

Packagist / dolibarr/dolibarr

Package

Name
dolibarr/dolibarr
Purl
pkg:composer/dolibarr/dolibarr

Affected ranges

Type
ECOSYSTEM
Events
Introduced
3.3.beta1
Fixed
14.0.0

Affected versions

3.*

3.6.0-beta
3.6.0
3.6.1
3.6.2
3.6.3
3.6.4
3.6.5
3.6.6
3.7.0
3.7.1
3.7.2
3.7.3
3.7.4
3.8.0-beta
3.8.0
3.8.1
3.8.2
3.8.3
3.8.4
3.9.0-rc
3.9.0-rc2
3.9.0
3.9.1
3.9.2
3.9.3
3.9.4

4.*

4.0.0-beta
4.0.0-rc
4.0.0-rc2
4.0.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0.5
4.0.6

5.*

5.0.0-beta
5.0.0-rc1
5.0.0-rc2
5.0.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7

6.*

6.0.0-beta
6.0.0-rc
6.0.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0.7
6.0.8

7.*

7.0.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5

8.*

8.0.0
8.0.1
8.0.2
8.0.3
8.0.4
8.0.5
8.0.6

9.*

9.0.0
9.0.1
9.0.2
9.0.3
9.0.4

10.*

10.0.0
10.0.1
10.0.2
10.0.3
10.0.4
10.0.5
10.0.6
10.0.7

11.*

11.0.0
11.0.1
11.0.2
11.0.3
11.0.4
11.0.5

12.*

12.0.0
12.0.1
12.0.2
12.0.3
12.0.4
12.0.5

13.*

13.0.0
13.0.1
13.0.2
13.0.3
13.0.4
13.0.5

Database specific 

{
    "last_known_affected_version_range": "< 13.0.2"
}