CVE-2021-25956mediumCWE-284

CVE-2021-25956: falha de média gravidade em dolibarr

Improper User Access Control in "Dolibarr" Leads to Account Takeover

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar dolibarr+ Monitorar dolibarr/dolibarr

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 4.7epss 0.9%
In “Dolibarr” application, v3.3.beta1_20121221 to v13.0.2 have “Modify” access for admin level users to change other user’s details but fails to validate already existing “Login” name, while renaming the user “Login”. This leads to complete account takeover of the victim user. This happens since the password gets overwritten for the victim user having a similar login name.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L
Produtos afetados
Dolibarr · dolibarr
CVEs relacionadas — dolibarr

No mesmo produto, das mais perigosas para as menos.

CVE-2026-116219HIGHDolibarr ERP CRM before 24.0.0 OS Command Injection via mysqldump ParameterEPSS 2.1%CVE-2026-34036MEDIUMDolibarr Core Discloses Sensitive Data via Authenticated Local File Inclusion in selectobject.phpEPSS 1.5%CVE-2021-25957HIGHAccount Takeover in "Dolibarr" via Password Reset FunctionalityEPSS 1.1%CVE-2026-23500CRITICALDolibarr: OS Command Injection (RCE) via MAIN_ODT_AS_PDF configurationEPSS 0.9%CVE-2021-25955CRITICALStored XSS in “Dolibarr” leads to privilege escalationEPSS 0.9%CVE-2025-67486HIGHDolibarr has an Authenticated Remote Code Execution via eval() injection in user extrafieldsEPSS 0.9%