CVE-2019-15062: CSRF
First published: Wed Aug 14 2019(Updated: )
An issue was discovered in Dolibarr 11.0.0-alpha. A user can store an IFRAME element (containing a user/card.php CSRF request) in his Linked Files settings page. When visited by the admin, this could completely take over the admin account. (The protection mechanism for CSRF is to check the Referer header; however, because the attack is from one of the application's own settings pages, this mechanism is bypassed.)
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| composer/dolibarr/dolibarr | >=10.0<10.0.2 | 10.0.2 |
| Dolibarr ERP & CRM | =11.0.0-alpha |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://gauravnarwani.com/publications/CVE-2019-15062/
- https://github.com/Dolibarr/dolibarr/issues/11671
- https://nvd.nist.gov/vuln/detail/CVE-2019-15062
- https://github.com/Dolibarr/dolibarr/commit/18eb2a83fe7c2d01bdb34cceec389a6f9541e1f6
- https://github.com/Dolibarr/dolibarr/commit/d21e5571007d2052a6b5f80a67b6f4cac693584a
- https://gauravnarwani.com/publications/CVE-2019-15062
- https://github.com/advisories/GHSA-4qq9-qg7j-fcm9 (Advisory)
Frequently Asked Questions
What is CVE-2019-15062?
CVE-2019-15062 is an issue discovered in Dolibarr ERP/CRM version 11.0.0-alpha.
What is the severity of CVE-2019-15062?
CVE-2019-15062 has a severity level of 8 (high).
How does CVE-2019-15062 affect Dolibarr?
CVE-2019-15062 allows a user to store a malicious IFRAME element that can compromise the admin account when visited by the admin.
What is the protection mechanism for CSRF in Dolibarr?
Dolibarr checks the Referer header to protect against CSRF attacks.
How can I fix CVE-2019-15062?
To fix CVE-2019-15062, update Dolibarr ERP/CRM to a version that is not affected by the vulnerability.
- agent/type
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-4qq9-qg7j-fcm9
- alias/CVE-2019-15062
- agent/software-canonical-lookup
- agent/weakness
- agent/severity
- agent/remedy
- agent/references
- agent/author
- agent/description
- agent/softwarecombine
- collector/github-advisory
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/first-publish-date
- agent/event
- agent/trending
- agent/source
- agent/tags
- collector/nvd-cve
- source/NVD
- agent/software-canonical-lookup-request
- collector/nvd-index
- package-manager/composer
- vendor/dolibarr
- canonical/dolibarr erp & crm
- version/dolibarr erp & crm/11.0.0-alpha