PT-2020-12873 · Dolibarr · Dolibarr

Published 2020-04-16 · Updated 2025-04-03 · CVE-2020-11825

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Dolibarr version 10.0.6

Description The issue arises from the fact that any Cross-Site Request Forgery (CSRF) token in any user's session can be used in another user's session. Normally, CSRF tokens should be unique to each user's session and not be valid when used across different sessions. This flaw allows for potential CSRF attacks, as an attacker could use a token from one session to perform unauthorized actions in another user's session.

Recommendations For Dolibarr version 10.0.6, as a temporary workaround, consider implementing additional validation to ensure CSRF tokens are tied to the user's session, restricting the use of tokens across different sessions until a proper fix is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

BIT-DOLIBARR-2020-11825

CVE-2020-11825

GHSA-M66X-WM27-XXPC

Affected Products

Dolibarr

References · 9

• 🔥 https://fatihhcelik.blogspot.com/2020/04/dolibarr-csrf.html · Exploit
• https://cve.org/CVERecord?id=CVE-2020-11825 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2020-11825 · Security Note
• https://osv.dev/vulnerability/CVE-2020-11825 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-11825 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-m66x-wm27-xxpc · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-11825 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-dolibarr-2020-11825 · Vendor Advisory
• https://github.com/Dolibarr/dolibarr · Note