CVE-2024-31503

HIGH

Dolibarr ERP CRM < 19.0.1 - Authenticated Session Cookie and CSRF Token Theft via Crafted Web Page

Title source: llm
STIX 2.1

Description

Incorrect access control in Dolibarr ERP CRM versions 19.0.0 and before, allows authenticated attackers to steal victim users' session cookies and CSRF protection tokens via user interaction with a crafted web page, leading to account takeover.

References (1)

Core 1

Scores

CVSS v3 7.5
EPSS 0.0026
EPSS Percentile 17.0%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:L

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact total

Details

CWE
CWE-284 CWE-352
Status published
Products (2)
dolibarr/dolibarr 0Packagist
dolibarr/dolibarr_erp\/crm < 19.0.1
Published Apr 17, 2024
Tracked Since Feb 18, 2026