Description

In Dolibarr 10.0.6, forms are protected with a CSRF token against CSRF attacks. The problem is any CSRF token in any user's session can be used in another user's session. CSRF tokens should not be valid in this situation.

Remediation

References

CVE-2020-11825

Related Vulnerabilities

WordPress Plugin Username Changer Multiple Vulnerabilities (1.4)

Rukovoditel Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Vulnerability (CVE-2020-13588)

Oracle JRE CVE-2018-2638 Vulnerability (CVE-2018-2638)

WordPress Plugin NextGEN Gallery-WordPress Gallery Local File Inclusion (2.1.7)

PHP Improper Control of Generation of Code ('Code Injection') Vulnerability (CVE-2018-19520)

Severity

High

Classification

CVE-2020-11825 CWE-352 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Tags

Missing Update Known Vulnerabilities