CVE-2017-8879: Medium severity dolibarr erp & crm vulnerability

Published May 10, 2017

Updated

Dolibarr ERP/CRM 4.0.4 allows password changes without supplying the current password, which makes it easier for physically proximate attackers to obtain access via an unattended workstation.

Affected Software

2 affected components

composer/dolibarr/dolibarr=4.0.4

dolibarr Dolibarr Erp\/crm=4.0.4

Event History

May 10, 2017

CVE Published

via MITRE·02:00 PM

Data Sourced

via MITRE·02:00 PM

Description

May 13, 2022

Advisory Published

via GitHub·01:47 AM

Frequently Asked Questions

What is the severity of CVE-2017-8879?

CVE-2017-8879 is considered a moderate severity vulnerability due to the potential for unauthorized password changes.

How do I fix CVE-2017-8879?

To fix CVE-2017-8879, upgrade to a patched version of Dolibarr ERP/CRM beyond 4.0.4 that requires the current password for changes.

Who is affected by CVE-2017-8879?

CVE-2017-8879 affects users of Dolibarr ERP/CRM version 4.0.4, especially in environments where workstations may be left unattended.

What can an attacker do with CVE-2017-8879?

An attacker with physical access to an unattended workstation could change the password without knowing the current one, gaining unauthorized access.

Is CVE-2017-8879 fixed in newer versions of Dolibarr?

Yes, CVE-2017-8879 has been addressed in versions of Dolibarr ERP/CRM released after 4.0.4.