CVE-2024-31503

HIGH

Dolibarr Erp/crm < 19.0.1 - Improper Access Control

Title source: rule
STIX 2.1

Description

Incorrect access control in Dolibarr ERP CRM versions 19.0.0 and before, allows authenticated attackers to steal victim users' session cookies and CSRF protection tokens via user interaction with a crafted web page, leading to account takeover.

References (1)

Core 1

Scores

CVSS v3 7.5
EPSS 0.0006
EPSS Percentile 17.7%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:L

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact total

Details

CWE
CWE-284 CWE-352
Status published
Products (2)
dolibarr/dolibarr 0Packagist
dolibarr/dolibarr_erp\/crm < 19.0.1
Published Apr 17, 2024
Tracked Since Feb 18, 2026