PT-2024-11006 · Dolibarr · Dolibarr

Published 2024-11-15 · Updated 2025-04-03 · CVE-2021-3991

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions Dolibarr versions prior to the 'develop' branch Dolibarr versions prior to 15.0.0 Dolibarr versions prior to 63cd063

Description An Improper Authorization issue exists, allowing a user with restricted permissions in the 'Reception' section to access specific reception details via direct URL access, bypassing intended permission restrictions.

Recommendations For versions prior to the 'develop' branch, update to the 'develop' branch or a newer version to mitigate the risk. For versions prior to 15.0.0, update to version 15.0.0 or a newer version to resolve the issue. For versions prior to 63cd063, update to version 63cd063 or a newer version to remediate the vulnerability. As a temporary workaround, consider restricting direct URL access to reception details for users with restricted permissions in the 'Reception' section until a patch is available.

Fix

Improper Authorization

IDOR

Weakness Enumeration

CWE-285

CWE-639

Related Identifiers

BIT-DOLIBARR-2021-3991

CVE-2021-3991

GHSA-WPPR-J57C-8JPM

Affected Products

Dolibarr

References · 15

• https://github.com/dolibarr/dolibarr/commit/63cd06394f39d60784d6e6a0ccf4867a71a6568f · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2021-3991 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-3991 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-wppr-j57c-8jpm · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-3991 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-3991 · Security Note
• https://ubuntu.com/security/CVE-2021-3991 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-dolibarr-2021-3991 · Vendor Advisory
• https://github.com/dolibarr/dolibarr · Note
• https://twitter.com/CVEnew/status/1857381727041368483 · Twitter Post
• https://twitter.com/transilienceai/status/1857654763875094905 · Twitter Post
• https://t.me/cvedetector/11066 · Telegram Post
• https://twitter.com/transilienceai/status/1857654770367914040 · Twitter Post
• https://t.me/cvenotify/102139 · Telegram Post
• https://huntr.com/bounties/58ddbd8a-0faf-4b3f-aec9-5850bb19ab67 · Note