CVE-2020-11825 — Cross-Site Request Forgery in Dolibarr

CWE-352 — Cross-Site Request Forgery5 documents4 sources
Severity
8.8HIGHNVD
EPSS
0.2%
top 58.30%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
DolibarrDolibarr ERP CRM
Timeline
PublishedApr 16
Latest updateMay 24

Description

In Dolibarr 10.0.6, forms are protected with a CSRF token against CSRF attacks. The problem is any CSRF token in any user's session can be used in another user's session. CSRF tokens should not be valid in this situation.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9

Affected Packages2 packages

▶Packagistdolibarr/dolibarr10.0.6

🔴Vulnerability Details

4
GHSA
Dolibarr Cross-Site Request Forgery Vulnerability↗2022-05-24
▶
OSV
Dolibarr Cross-Site Request Forgery Vulnerability↗2022-05-24
▶
CVEList
CVE-2020-11825: In Dolibarr 10↗2020-04-16
▶
OSV
CVE-2020-11825: In Dolibarr 10↗2020-04-16
▶
CVE-2020-11825 — Cross-Site Request Forgery in Dolibarr | cvebase