High severity · published Apr 17, 2024
CVE-2024-31503
Incorrect access control in Dolibarr ERP CRM versions 19.0.0 and before, allows authenticated attackers to steal victim users' session cookies and CSRF protection tokens via user…
7.5
CVSS
0.3%
EPSS
No
On KEV
Description
Incorrect access control in Dolibarr ERP CRM versions 19.0.0 and before, allows authenticated attackers to steal victim users' session cookies and CSRF protection tokens via user interaction with a crafted web page, leading to account takeover.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:L
Attack vector
Network
Complexity
High
Privileges
High
User interaction
Required
Confidentiality
High
Integrity
High
Availability
Low
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 17% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DE
Dolibarr Erp/crm · Dolibarr
before 19.0.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-31503
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-31503
Third Party Advisory
https://github.com/alexbsec/CVEs/blob/master/2024/CVE-2024-31503.md
More from Dolibarr Erp/crm
9.8
CVE-2018-25357
Dolibarr ERP CRM 7.0.3 Remote Code Execution via install/step1.php
9.8
CVE-2022-4093
SQL injection attacks can result in unauthorized access to sensitive data, such as passwords, credit card details, or personal user information
9.8
CVE-2022-43138
Dolibarr Open Source ERP & CRM for Business before v14.0.1 allows attackers to escalate privileges via a crafted API
9.8
CVE-2022-40871
Dolibarr ERP & CRM <=15.0.3 is vulnerable to Eval injection
9.8
CVE-2022-0224
dolibarr is vulnerable to Improper Neutralization of Special Elements used in an SQL Command