CVE-2021-25957: Account Takeover in "Dolibarr" via Password Reset Functionality
In “Dolibarr” application, v2.8.1 to v13.0.2 are vulnerable to account takeover via password reset functionality. A low privileged attacker can reset the password of any user in the application using the password reset link the user received through email when requested for a forgotten password.
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is CVE-2021-25957?
CVE-2021-25957 is a vulnerability found in the Dolibarr application, versions 2.8.1 to 13.0.2, which allows a low privileged attacker to take over user accounts via the password reset functionality.
How severe is CVE-2021-25957?
CVE-2021-25957 has a severity rating of 8.8, which is considered high.
How can an attacker exploit CVE-2021-25957?
An attacker can exploit CVE-2021-25957 by using the password reset link received through email to reset the password of any user in the Dolibarr application.
Is there a fix for CVE-2021-25957?
Yes, a fix for CVE-2021-25957 is available. It is recommended to update Dolibarr to a version higher than 13.0.2 to mitigate the vulnerability.
Where can I find more information about CVE-2021-25957?
You can find more information about CVE-2021-25957 on the GitHub commit and the WhiteSource Software vulnerability database.