CVE-2019-15062: CSRF
An issue was discovered in Dolibarr 11.0.0-alpha. A user can store an IFRAME element (containing a user/card.php CSRF request) in his Linked Files settings page. When visited by the admin, this could completely take over the admin account. (The protection mechanism for CSRF is to check the Referer header; however, because the attack is from one of the application's own settings pages, this mechanism is bypassed.)
Other sources
An issue was discovered in Dolibarr. A user can store an IFRAME element (containing a user/card.php CSRF request) in his Linked Files settings page. When visited by the admin, this could completely take over the admin account. (The protection mechanism for CSRF is to check the Referer header; however, because the attack is from one of the application's own settings pages, this mechanism is bypassed.)
— GitHub
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2019-15062?
CVE-2019-15062 is an issue discovered in Dolibarr ERP/CRM version 11.0.0-alpha.
What is the severity of CVE-2019-15062?
CVE-2019-15062 has a severity level of 8 (high).
How does CVE-2019-15062 affect Dolibarr?
CVE-2019-15062 allows a user to store a malicious IFRAME element that can compromise the admin account when visited by the admin.
What is the protection mechanism for CSRF in Dolibarr?
Dolibarr checks the Referer header to protect against CSRF attacks.
How can I fix CVE-2019-15062?
To fix CVE-2019-15062, update Dolibarr ERP/CRM to a version that is not affected by the vulnerability.