Skip to content
OpenAdvisories
High · 8.8 Public exploit CVE-2019-1010054 EUVD-2022-4229GHSA-hwmc-v6j6-gc2p

Dolibarr Cross Site Request Forgery (CSRF)

Published Jul 18, 2019 · Updated Aug 5, 2024 · Assigned by dwf

Vendor: Dolibarr ERP & CRM Product: Dolibarr Package: dolibarr Package: dolibarr/dolibarr Ecosystem: Packagist Ecosystem: Ubuntu

Description

Dolibarr 7.0.0 is affected by: Cross Site Request Forgery (CSRF). The impact is: allow malitious html to change user password, disable users and disable password encryptation. The component is: Function User password change, user disable and password encryptation. The attack vector is: admin access malitious urls.

Affected products

VendorProductAffectedFixed
Dolibarr ERP & CRM Dolibarr 7.0.0 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu Pro 16.04 LTS dolibarr No fix yet —

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 1 repository

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Affected packages

EcosystemPackageAffectedFixedRecord
Packagist dolibarr/dolibarr 7.0.0 — GHSA-hwmc-v6j6-gc2p

References