CVE-2021-25957
Fixed upstream EPSS 1%CVSS 8.8
In “Dolibarr” application, v2.8.1 to v13.0.2 are vulnerable to account takeover via password reset functionality. A low privileged attacker can reset the password of any user in the application using the password reset link the user received through email when requested for a forgotten password.
Products: dolibarr
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Packagist | dolibarr/dolibarr | 14.0.0 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu Pro 16.04 LTS | dolibarr | no fix |