PT-2024-24124 · Unknown · Dolibarr Erp/Crm

Arthur Valverde M + 1 · Published 2024-04-16 · Updated 2025-06-14 · CVE-2024-31503

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:L

Name of the Vulnerable Software and Affected Versions Dolibarr ERP CRM versions 19.0.0 and before

Description The issue allows authenticated attackers to steal victim users' session cookies and CSRF protection tokens via user interaction with a crafted web page, leading to account takeover. This occurs due to incorrect access control in the software.

Recommendations For versions 19.0.0 and before, update to a version that includes the necessary access control fixes to prevent session cookie and CSRF token theft. As a temporary workaround, consider restricting user interaction with crafted web pages to minimize the risk of exploitation.

Exploit

Fix

Improper Access Control

CSRF

Weakness Enumeration

CWE-284

CWE-352

Related Identifiers

BIT-DOLIBARR-2024-31503

CVE-2024-31503

GHSA-6PPG-RGRG-F573

Affected Products

Dolibarr Erp/Crm

References · 13

• 🔥 https://github.com/alexbsec/CVEs/blob/master/2024/CVE-2024-31503.md · Exploit
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-31503 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-31503 · Security Note
• https://osv.dev/vulnerability/GHSA-6ppg-rgrg-f573 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-dolibarr-2024-31503 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2024-31503 · Security Note
• https://osv.dev/vulnerability/CVE-2024-31503 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-31503 · Vendor Advisory
• https://github.com/Dolibarr/dolibarr · Note
• https://t.me/cvenotify/76983 · Telegram Post
• https://t.me/cvenotify/125653 · Telegram Post
• https://twitter.com/CVEnew/status/1780416379180691945 · Twitter Post
• https://t.me/cvenotify/91193 · Telegram Post