PT-2019-11451 · Dolibarr · Dolibarr

Published 2019-07-18 · Updated 2022-11-17 · CVE-2019-1010054

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Dolibarr version 7.0.0

Description: The issue allows malicious HTML to change user passwords, disable users, and disable password encryption. It is related to the function that handles user password changes, user disablement, and password encryption. The attack vector involves admin access to malicious URLs.

Recommendations: For Dolibarr version 7.0.0, consider disabling the user password change, user disable, and password encryption functions until a fix is available. Restrict access to admin URLs to minimize the risk of exploitation.

Exploit

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2019-1010054

GHSA-HWMC-V6J6-GC2P

Affected Products

Dolibarr

References · 8

• 🔥 https://github.com/lucasgcilento/CVE/blob/master/Dolibarr_CSRF · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-1010054 · Security Note
• https://cve.org/CVERecord?id=CVE-2019-1010054 · Security Note
• https://ubuntu.com/security/CVE-2019-1010054 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-hwmc-v6j6-gc2p · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2019-1010054 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-1010054 · Vendor Advisory
• https://github.com/Dolibarr/dolibarr · Note