CVE-2024-31503
No fix known EPSS <1%CVSS 7.5
Incorrect access control in Dolibarr ERP CRM versions 19.0.0 and before, allows authenticated attackers to steal victim users' session cookies and CSRF protection tokens via user interaction with a crafted web page, leading to account takeover.
Products: dolibarr_erp/crm
Affected upstream, no fix yet
| Ecosystem | Package |
|---|---|
| Packagist | dolibarr/dolibarr |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu Pro 16.04 LTS | dolibarr | no fix |