GitHub Advisoryadvisory · Packagist

GHSA-74c7-r9m3-hvj4 Dolibarr cross-site scripting (XSS) vulnerability

MEDIUM Published 2022-05-17 Modified 2024-04-24 Official page ↗
Aliases
CVE-2017-14239
Ecosystem
Packagist
Packages
dolibarr/dolibarr
Severity
Moderate
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-79
Reviewed
2024-04-24

Affected packages

• Packagist dolibarr/dolibarr: >= 6.0.0, < 6.0.1 → fixed in 6.0.1

Description

Multiple cross-site scripting (XSS) vulnerabilities in Dolibarr ERP/CRM 6.0.0 allow remote authenticated users to inject arbitrary web script or HTML via the (1) CompanyName, (2) CompanyAddress, (3) CompanyZip, (4) CompanyTown, (5) Fax, (6) EMail, (7) Web, (8) ManagingDirectors, (9) Note, (10) Capital, (11) ProfId1, (12) ProfId2, (13) ProfId3, (14) ProfId4, (15) ProfId5, or (16) ProfId6 parameter to htdocs/admin/company.php.

Related

Alias · CVE (1)

  • CVE-2017-14239 Multiple cross-site scripting (XSS) vulnerabilities in Dolibarr ERP/CRM 6.0.0 allow remote authenticated users to inject arbitrary web… vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References