PT-2021-16881 · Dolibarr · Dolibarr

Hagai Wechsler · Published 2021-08-17 · Updated 2021-09-02 · CVE-2021-25957

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Dolibarr versions 2.8.1 through 13.0.2

Description The issue allows a low privileged attacker to take over accounts via the password reset functionality. This is achieved by exploiting the password reset link sent to users via email when they request a forgotten password.

Recommendations For versions 2.8.1 through 13.0.2, consider disabling the password reset functionality until a patch is available to prevent account takeover. Restrict access to the password reset link to minimize the risk of exploitation. Avoid using the password reset feature in the affected application until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-640

Related Identifiers

CVE-2021-25957

GHSA-C32W-3CQH-F6JX

Affected Products

Dolibarr

References · 12

• https://github.com/Dolibarr/dolibarr/commit/87f9530272925f0d651f59337a35661faeb6f377 · Patch
• https://osv.dev/vulnerability/CVE-2021-25957 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-25957 · Security Note
• https://ubuntu.com/security/CVE-2021-25957 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-25957 · Security Note
• https://osv.dev/vulnerability/GHSA-c32w-3cqh-f6jx · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-25957 · Vendor Advisory
• https://github.com/Dolibarr/dolibarr · Note
• https://t.me/cibsecurity/27428 · Telegram Post
• https://t.me/cvenotify/20019 · Telegram Post
• https://whitesourcesoftware.com/vulnerability-database/CVE-2021-25957 · Note
• https://t.me/cvenotify/19521 · Telegram Post