Dolibarr Cross-Site Request Forgery Vulnerability
High severity
GitHub Reviewed
Published
May 24, 2022
to the GitHub Advisory Database
•
Updated Jul 17, 2023
Description
Published by the National Vulnerability Database
Apr 16, 2020
Published to the GitHub Advisory Database
May 24, 2022
Reviewed
Jul 17, 2023
Last updated
Jul 17, 2023
In Dolibarr 10.0.6, forms are protected with a Cross-Site Request Forgery (CSRF) token against CSRF attacks. The problem is any CSRF token in any user's session can be used in another user's session. CSRF tokens should not be valid in this situation.
References