CyberRota Analysis
AI-GeneratedDolibarr versions prior to 24.0.0 are vulnerable to a sensitive data exposure issue in the Members REST API, allowing authenticated attackers with member-read rights to access bcrypt password verifiers through member endpoints. This vulnerability can lead to offline password cracking attacks, compromising user accounts. Organizations using Dolibarr should prioritize patching this issue to protect sensitive user data.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Dolibarr before 24.0.0 contains a sensitive data exposure vulnerability in the Members REST API that allows authenticated attackers with member-read rights to retrieve bcrypt password verifiers by querying member endpoints. Attackers can call the individual member or member list endpoints to obtain crypted password verifier fields that are not filtered by the base API serializer or the Members API class, potentially enabling offline password cracking attacks.