GHSA-m66x-wm27-xxpc
Dolibarr Cross-Site Request Forgery Vulnerability
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Packagist | dolibarr/dolibarr | <= 10.0.6 | no fix listed |
Details
As written in the advisory (Markdown source, shown as plain text).
In Dolibarr 10.0.6, forms are protected with a Cross-Site Request Forgery (CSRF) token against CSRF attacks. The problem is any CSRF token in any user's session can be used in another user's session. CSRF tokens should not be valid in this situation.
References
External links from the advisory. They lead to third-party sites.