CVE-2021-25957
High
Description
In “Dolibarr” application, v2.8.1 to v13.0.2 are vulnerable to account takeover via password reset functionality. A low privileged attacker can reset the password of any user in the application using the password reset link the user received through email when requested for a forgotten password.
SeverityHigh
CVSS8.8
Exploit probability—
ProductDolibarr
PublishedAug 17, 2021
First seenAug 17, 2021
Weakness typeCWE-640CWE-640
How to fix
Update
- dolibarr/dolibarr14.0.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| dolibarr dolibarr | 2.8.1 ≤ v ≤ 13.0.2 | — |
| dolibarr/dolibarrPackagist | v < 14.0.0 | 14.0.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.