GitHub Advisoryadvisory · Packagist

GHSA-6fw8-vf2x-4wpm Dolibarr ERP and CRM contain Cross-site Scripting Vulnerability

MEDIUM Published 2022-05-17 Modified 2023-08-03 Official page ↗
Aliases
CVE-2015-3935
Ecosystem
Packagist
Packages
dolibarr/dolibarr
Severity
Moderate
Weaknesses
CWE-79
Reviewed
2023-08-03

Affected packages

• Packagist dolibarr/dolibarr: >= 3.5.0, < 3.5.8 → fixed in 3.5.8

Description

Multiple cross-site scripting (XSS) vulnerabilities in Dolibarr ERP/CRM 3.5 and 3.6 allow remote attackers to inject arbitrary web script or HTML via the Business Search (`search_nom`) field to (1) `htdocs/societe/societe.php` or (2) `htdocs/societe/admin/societe.php`.

Related

Alias · CVE (1)

  • CVE-2015-3935 Multiple cross-site scripting (XSS) vulnerabilities in Dolibarr ERP/CRM 3.5 and 3.6 allow remote attackers to inject arbitrary web script… vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References