CVE-2024-31503

CVSS 7.5 HIGHEPSS 0.3%CWE-284

Vexday Risk Score

21Low

SSVC decision (CISA)

Track

No exploitation signal → monitor

CVSS 7.5EPSS 0.3%KEV nãoPoC —Nuclei —Metasploit —Patch —

Lifecycle

16 Apr 2024Published on NVD

Recommendation: Monitor — no exploitation signal at the moment.

Incorrect access control in Dolibarr ERP CRM versions 19.0.0 and before, allows authenticated attackers to steal victim users' session cookies and CSRF protection tokens via user interaction with a crafted web page, leading to account takeover.

CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:L

Affected products

n/a · n/a

References

https://github.com/alexbsec/CVEs/blob/master/2024/CVE-2024-31503.md