CVE-2021-25954
09.08.2021, 17:15
In Dolibarr application, 2.8.1 to 13.0.4 dont restrict or incorrectly restricts access to a resource from an unauthorized actor. A low privileged attacker can modify the Private Note which only an administrator has rights to do, the affected field is at /adherents/note.php?id=1 endpoint.Enginsight
| Vendor | Product | Version |
|---|---|---|
| dolibarr | dolibarr | 2.8.1 ≤ 𝑥 ≤ 13.0.4 |
𝑥
= Vulnerable software versions
Ubuntu Releases
Common Weakness Enumeration
- CWE-284 - Improper Access ControlThe software does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
- CWE-863 - Incorrect AuthorizationThe software performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.
References