PT-2017-18601 · Dolibarr · Dolibarr Erp/Crm

CVE-2017-8879 · Publicado 2017-05-10 · Atualizado 2022-11-17

Positive Technologies (AI Summary)

CVSS v3.1

6.8

Média

Vetor base

AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Dolibarr ERP/CRM version 4.0.4

Description The issue allows password changes without requiring the current password, making it easier for attackers with physical access to obtain access via an unattended workstation.

Recommendations For Dolibarr ERP/CRM version 4.0.4, consider implementing a workaround that requires the current password for password changes until a patch is available. As a temporary mitigation measure, restrict access to workstations with active sessions to minimize the risk of exploitation.

Exploit

Correção

Improper Authentication

Enumeração de Fraquezas

CWE-287

Identificadores relacionados

CVE-2017-8879

GHSA-5X4J-XCMV-V3Q2

Produtos afetados

Dolibarr Erp/Crm

Referências · 8

• 🔥 https://foxmole.com/advisories/foxmole-2017-02-23.txt · Exploit
• https://github.com/Dolibarr/dolibarr · Nota
• https://ubuntu.com/security/CVE-2017-8879 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-8879 · Nota de Segurança
• https://osv.dev/vulnerability/UBUNTU-CVE-2017-8879 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2017-8879 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-5x4j-xcmv-v3q2 · Aviso do Fabricante
• https://cve.org/CVERecord?id=CVE-2017-8879 · Nota de Segurança