GitHub Advisoryadvisory · Packagist

GHSA-f848-r5g6-6gpf Dolibarr Stored Cross-site Scripting

MEDIUM Published 2022-05-24 Modified 2024-04-24 Official page ↗
Aliases
CVE-2020-13240
Ecosystem
Packagist
Packages
dolibarr/dolibarr
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Weaknesses
CWE-276, CWE-668, CWE-79
Reviewed
2024-04-24

Affected packages

• Packagist dolibarr/dolibarr: 11.0.4 (no fix yet)

Description

The DMS/ECM module in Dolibarr 11.0.4 allows users with the 'Setup documents directories' permission to rename uploaded files to have insecure file extensions. This bypasses the .noexe protection mechanism against XSS.

Related

Alias · CVE (1)

  • CVE-2020-13240 The DMS/ECM module in Dolibarr 11.0.4 allows users with the 'Setup documents directories' permission to rename uploaded files to have… vulnerability

Weakness · CWE (3)

  • CWE-276 Incorrect Default Permissions weakness
  • CWE-668 Exposure of Resource to Wrong Sphere weakness
  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References