CVE-2017-8879: Dolibarr ERP/CRM 4.0.4 Password Change Vulnerability
Summary
CVE-2017-8879: Dolibarr allows password changes without supplying the current password. Affects dolibarr/dolibarr versions 4.0.4. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Dolibarr is an open-source ERP/CRM software that provides a comprehensive suite of business management tools. It is designed to streamline various processes such as accounting, inventory management, customer relationship management, and more. Dolibarr is widely used by organizations to enhance their operational efficiency and productivity. However, version 4.0.4 of Dolibarr is vulnerable to a security issue that allows password changes without requiring the current password. This vulnerability poses a risk when an attacker gains physical access to an unattended workstation, enabling them to obtain unauthorized access to the system.
Vulnerability Detail
The vulnerability in Dolibarr ERP/CRM 4.0.4 allows an attacker to change a user's password without providing the current password. This means that if an attacker gains physical access to a workstation where a user is logged in, they can change the user's password without any authentication. This vulnerability can be exploited to gain unauthorized access to the system and potentially compromise sensitive data. It is important to note that this vulnerability requires physical proximity to the target system, limiting the scope of potential attackers to those who can physically access the workstation.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can implement additional physical security measures to prevent unauthorized access to workstations. This can include locking workstations when unattended, restricting physical access to sensitive areas, and implementing surveillance systems to monitor physical access to workstations. While these measures can help mitigate the risk, they do not address the underlying vulnerability and should be considered temporary solutions until the software is updated.
Conclusion
The vulnerability in Dolibarr ERP/CRM 4.0.4 allows an attacker with physical access to an unattended workstation to change a user's password without authentication. This can lead to unauthorized access to the system and potential compromise of sensitive data. To mitigate this risk, it is crucial to update Dolibarr to a version that includes the necessary security patches and implement additional physical security measures. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for dolibarr/dolibarr →
FAQ
Dolibarr ERP/CRM is an open-source software that provides a suite of business management tools for organizations. It helps streamline various processes such as accounting, inventory management, and customer relationship management.
This vulnerability allows an attacker with physical access to an unattended workstation to change a user's password without authentication. This can lead to unauthorized access to the system and potential compromise of sensitive data.
To fix this vulnerability, it is recommended to update Dolibarr to a version that includes the necessary security patches. By updating to a patched version, the password change functionality will require the user to provide the current password, ensuring proper authentication.
As a temporary workaround, users can implement additional physical security measures to prevent unauthorized access to workstations. This includes locking workstations when unattended, restricting physical access to sensitive areas, and implementing surveillance systems.
If you are using Dolibarr ERP/CRM 4.0.4 and an attacker gains physical access to an unattended workstation, your data may be at risk. It is recommended to update to a patched version and implement additional physical security measures to mitigate the risk.
Related vulnerabilities
Recent vulnerabilities recorded for dolibarr/dolibarr.
