{"id":"CVE-2019-1010054","aliases":["EUVD-2022-4229","GHSA-hwmc-v6j6-gc2p","UBUNTU-CVE-2019-1010054"],"status":"published","title":"Dolibarr Cross Site Request Forgery (CSRF)","description":"Dolibarr 7.0.0 is affected by: Cross Site Request Forgery (CSRF). The impact is: allow malitious html to change user password, disable users and disable password encryptation. The component is: Function User password change, user disable and password encryptation. The attack vector is: admin access malitious urls.","severity":{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.02186,"percentile":0.82532,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-352"],"published":"2019-07-18T12:52:13Z","modified":"2026-10-24T10:30:32Z","exploits":[{"source":"pocgithub","id":"chaizeg/CSRF-breach","title":"chaizeg/CSRF-breach","date":"2020-04-13","url":"https://github.com/chaizeg/CSRF-breach"}],"affected":[{"source":"ghsa","ecosystem":"Packagist","package":"dolibarr/dolibarr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.0"},{"last_affected":"7.0.0"}]}],"versions":["7.0.0"]},{"source":"osv","ecosystem":"Packagist","package":"dolibarr/dolibarr","versions":["7.0.0"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"dolibarr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.5.5+dfsg1-2","3.5.7+dfsg1-1","3.5.8+dfsg1-1","3.5.8+dfsg1-1ubuntu1","3.5.8+dfsg1-1ubuntu1+esm1"]}],"products":[{"vendor":"dolibarr","product":"dolibarr"},{"vendor":"dolibarr","product":"dolibarr_erp\\/crm"},{"vendor":"dolibarr erp \u0026 crm","product":"dolibarr"}],"references":[{"url":"https://github.com/lucasgcilento/CVE/blob/master/Dolibarr_CSRF","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","evidence","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-1010054","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-hwmc-v6j6-gc2p"},{"url":"https://github.com/Dolibarr/dolibarr","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2019-1010054","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-1010054","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2019-1010054","description":"Dolibarr 7.0.0 is affected by: Cross Site Request Forgery (CSRF). The impact is: allow malitious html to change user password, disable users and disable password encryptation. The component is: Function User password change, user disable and password encryptation. The attack vector is: admin access malitious urls.","status":"published","published":"2019-07-18T12:52:13Z","modified":"2024-08-05T03:07:18.176Z","updated_at":"2026-11-02T14:20:24.989116Z"}],"euvd":[{"id":"EUVD-2022-4229","description":"Dolibarr 7.0.0 is affected by: Cross Site Request Forgery (CSRF). The impact is: allow malitious html to change user password, disable users and disable password encryptation. The component is: Function User password change, user disable and password encryptation. The attack vector is: admin access malitious urls.","status":"published","published":"2019-07-18T12:52:13Z","modified":"2024-08-05T03:07:18Z","updated_at":"2026-11-03T02:40:18.85013Z"}],"ghsa":[{"id":"GHSA-hwmc-v6j6-gc2p","title":"Dolibarr Cross Site Request Forgery (CSRF)","description":"Dolibarr 7.0.0 is affected by: Cross Site Request Forgery (CSRF). The impact is: allow malitious html to change user password, disable users and disable password encryptation. The component is: Function User password change, user disable and password encryptation. The attack vector is: admin access malitious urls.","status":"published","published":"2022-05-24T16:50:37Z","modified":"2024-05-04T05:02:19Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-352"],"updated_at":"2026-11-02T14:37:48.08826Z"}],"nvd":[{"id":"CVE-2019-1010054","description":"Dolibarr 7.0.0 is affected by: Cross Site Request Forgery (CSRF). The impact is: allow malitious html to change user password, disable users and disable password encryptation. The component is: Function User password change, user disable and password encryptation. The attack vector is: admin access malitious urls.","status":"published","published":"2019-07-18T13:15:11.063Z","modified":"2026-06-17T02:09:45.253Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-352"],"updated_at":"2026-11-02T14:05:20.616405Z"}],"osv":[{"id":"CVE-2019-1010054","description":"Dolibarr 7.0.0 is affected by: Cross Site Request Forgery (CSRF). The impact is: allow malitious html to change user password, disable users and disable password encryptation. The component is: Function User password change, user disable and password encryptation. The attack vector is: admin access malitious urls.","status":"published","published":"2019-07-18T13:15:11.063Z","modified":"2026-10-24T10:30:32.269189378Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:10.051046Z"},{"id":"GHSA-hwmc-v6j6-gc2p","title":"Dolibarr Cross Site Request Forgery (CSRF)","description":"Dolibarr 7.0.0 is affected by: Cross Site Request Forgery (CSRF). The impact is: allow malitious html to change user password, disable users and disable password encryptation. The component is: Function User password change, user disable and password encryptation. The attack vector is: admin access malitious urls.","status":"published","published":"2022-05-24T16:50:37Z","modified":"2024-04-24T21:01:44.125818Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-352"],"updated_at":"2026-11-02T15:46:49.621585Z"},{"id":"UBUNTU-CVE-2019-1010054","description":"Dolibarr 7.0.0 is affected by: Cross Site Request Forgery (CSRF). The impact is: allow malitious html to change user password, disable users and disable password encryptation. The component is: Function User password change, user disable and password encryptation. The attack vector is: admin access malitious urls.","status":"published","published":"2019-07-18T13:15:00Z","modified":"2026-06-17T20:15:13.941615797Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:18.772093Z"}]}}