PT-2021-3962 · Dolibarr · Dolibarr

Hagai Wechsler · Published 2021-08-09 · Updated 2022-10-25 · CVE-2021-25954

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Dolibarr versions 2.8.1 through 13.0.4

Description The issue is related to inadequate access control in the Dolibarr application, allowing a low-privileged attacker to modify the Private Note, which is only supposed to be accessible by administrators. The affected field is located at the "/adherents/note.php?id=1" endpoint. This could potentially impact the integrity of protected information.

Recommendations For versions 2.8.1 through 13.0.4, consider restricting access to the "/adherents/note.php?id=1" endpoint to prevent unauthorized modification of the Private Note. As a temporary workaround, consider disabling the modification of Private Notes for low-privileged users until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Incorrect Authorization

Improper Access Control

Weakness Enumeration

CWE-863

CWE-284

Related Identifiers

BDU:2021-04481

CVE-2021-25954

GHSA-VXHC-C4QM-647P

Affected Products

Dolibarr

References · 11

• https://github.com/Dolibarr/dolibarr/commit/8cc100012d46282799fb19f735a53b7101569377 · Patch
• https://cve.org/CVERecord?id=CVE-2021-25954 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-25954 · Security Note
• https://osv.dev/vulnerability/GHSA-vxhc-c4qm-647p · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-25954 · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-04481 · Security Note
• https://ubuntu.com/security/CVE-2021-25954 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-25954 · Vendor Advisory
• https://github.com/Dolibarr/dolibarr · Note
• https://whitesourcesoftware.com/vulnerability-database/CVE-2021-25954 · Note
• https://t.me/cibsecurity/27019 · Telegram Post