{"id":"GHSA-5x4j-xcmv-v3q2","aliases":["CVE-2017-8879"],"title":"Dolibarr allows password changes without supplying the current password","description":"Dolibarr ERP/CRM 4.0.4 allows password changes without supplying the current password, which makes it easier for physically proximate attackers to obtain access via an unattended workstation.","severity":"medium","score":6.8,"published":"2022-05-13T01:47:44.000Z","modified":"2024-04-24T21:11:36.613Z","withdrawn":false,"knownExploited":false,"affected":[{"ecosystem":"Packagist","name":"dolibarr/dolibarr","ranges":[],"versions":["4.0.4"],"fixed":[]}],"references":["https://nvd.nist.gov/vuln/detail/CVE-2017-8879","https://github.com/Dolibarr/dolibarr","https://www.foxmole.com/advisories/foxmole-2017-02-23.txt"],"sources":[{"name":"OSV","id":"GHSA-5x4j-xcmv-v3q2","modified":"2024-04-24T21:11:36.613070Z","url":"https://osv.dev/vulnerability/GHSA-5x4j-xcmv-v3q2"}],"assessments":[{"source":"OSV","vector":"CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","score":6.8}]}