PT-2017-18601 · Dolibarr · Dolibarr Erp/Crm

Published 2017-05-10 · Updated 2022-11-17 · CVE-2017-8879

Positive Technologies (AI Summary)

CVSS v3.1

6.8

Medium

Base vector

AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Dolibarr ERP/CRM version 4.0.4

Description The issue allows password changes without requiring the current password, making it easier for attackers with physical access to obtain access via an unattended workstation.

Recommendations For Dolibarr ERP/CRM version 4.0.4, consider implementing a workaround that requires the current password for password changes until a patch is available. As a temporary mitigation measure, restrict access to workstations with active sessions to minimize the risk of exploitation.

Exploit

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2017-8879

GHSA-5X4J-XCMV-V3Q2

Affected Products

Dolibarr Erp/Crm

References · 8

• 🔥 https://foxmole.com/advisories/foxmole-2017-02-23.txt · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2017-8879 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2017-8879 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-5x4j-xcmv-v3q2 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-8879 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-8879 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2017-8879 · Security Note
• https://github.com/Dolibarr/dolibarr · Note