p PatchFirst

CVE-2021-25954

CVE-2021-25954 · Improper Access Control in “Dolibarr”

This page contains facts from public vulnerability sources. Check the original advisory before updating.

In “Dolibarr” application, 2.8.1 to 13.0.4 don’t restrict or incorrectly restricts access to a resource from an unauthorized actor. A low privileged attacker can modify the Private Note which only an administrator has rights to do, the affected field is at “/adherents/note.php?id=1” endpoint.

CVSS 4.3 · Medium · EPSS 0.7% · Fix available

Published
Updated

Stack: system · php

Affected products and versions

  • dolibarr

    Versions
    • ≥ 2.8.1, < unspecified: Affected (custom)
    • ≥ unspecified, ≤ 13.0.4: Affected (custom)

    No fix published

  • dolibarr/dolibarr Packagist

    Versions
    • 10.0.0
    • 10.0.1
    • 10.0.2
    • 10.0.3
    • 10.0.4
    • 10.0.5
    • 10.0.6
    • 10.0.7
    • 11.0.0
    • 11.0.1
    • 11.0.2
    • 11.0.3
    • 11.0.4
    • 11.0.5
    • 12.0.0
    • 12.0.1
    • 12.0.2
    • 12.0.3
    • 12.0.4
    • 12.0.5
    • 13.0.0
    • 13.0.1
    • 13.0.2
    • 13.0.3
    • 13.0.4
    • 13.0.5
    • 3.6.0
    • 3.6.0-beta
    • 3.6.1
    • 3.6.2
    • 3.6.3
    • 3.6.4
    • 3.6.5
    • 3.6.6
    • 3.7.0
    • 3.7.1
    • 3.7.2
    • 3.7.3
    • 3.7.4
    • 3.8.0
    • 3.8.0-beta
    • 3.8.1
    • 3.8.2
    • 3.8.3
    • 3.8.4
    • 3.9.0
    • 3.9.0-rc
    • 3.9.0-rc2
    • 3.9.1
    • 3.9.2
    • 3.9.3
    • 3.9.4
    • 4.0.0
    • 4.0.0-beta
    • 4.0.0-rc
    • 4.0.0-rc2
    • 4.0.1
    • 4.0.2
    • 4.0.3
    • 4.0.4
    • 4.0.5
    • 4.0.6
    • 5.0.0
    • 5.0.0-beta
    • 5.0.0-rc1
    • 5.0.0-rc2
    • 5.0.1
    • 5.0.2
    • 5.0.3
    • 5.0.4
    • 5.0.5
    • 5.0.6
    • 5.0.7
    • 6.0.0
    • 6.0.0-beta
    • 6.0.0-rc
    • 6.0.1
    • 6.0.2
    • 6.0.3
    • 6.0.4
    • 6.0.5
    • 6.0.6
    • 6.0.7
    • 6.0.8
    • 7.0.0
    • 7.0.1
    • 7.0.2
    • 7.0.3
    • 7.0.4
    • 7.0.5
    • 8.0.0
    • 8.0.1
    • 8.0.2
    • 8.0.3
    • 8.0.4
    • 8.0.5
    • 8.0.6
    • 9.0.0
    • 9.0.1
    • 9.0.2
    • 9.0.3
    • 9.0.4
    Affected ranges
    • ECOSYSTEM: ≥ 2.8.1, < 14.0.0

    Update to 14.0.0

  • dolibarr Ubuntu:Pro:16.04:LTS

    Versions
    • 3.5.5+dfsg1-2
    • 3.5.7+dfsg1-1
    • 3.5.8+dfsg1-1
    • 3.5.8+dfsg1-1ubuntu1
    • 3.5.8+dfsg1-1ubuntu1+esm1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →