CVE-2024-31503
Publication date 17 April 2024
Last updated 26 August 2025
Ubuntu priority
Description
Incorrect access control in Dolibarr ERP CRM versions 19.0.0 and before, allows authenticated attackers to steal victim users' session cookies and CSRF protection tokens via user interaction with a crafted web page, leading to account takeover.
Status
| Package | Ubuntu Release | Status |
|---|---|---|
| dolibarr | 25.10 questing | Not in release |
| 24.04 LTS noble | Not in release | |
| 22.04 LTS jammy | Not in release | |
| 20.04 LTS focal | Not in release | |
| 16.04 LTS xenial |
Needs evaluation
|
Severity score breakdown
| Parameter | Value |
|---|---|
| Base score |
7.5 · High
|
| Attack vector | Network |
| Attack complexity | High |
| Privileges required | High |
| User interaction | Required |
| Scope | Changed |
| Confidentiality | High |
| Integrity impact | High |
| Availability impact | Low |
| Vector | CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:L |