Cross-site Scripting (XSS) Affecting dolibarr/dolibarr package, versions <10.0.3


Severity

Recommended
0.0
medium
0
10

CVSS assessment made by Snyk's Security Team. Learn more

Threat Intelligence

Exploit Maturity
Proof of concept
EPSS
0.06% (29th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications

Snyk Learn

Learn about Cross-site Scripting (XSS) vulnerabilities in an interactive lesson.

Start learning
  • Snyk IDSNYK-PHP-DOLIBARRDOLIBARR-560378
  • published16 Mar 2020
  • disclosed16 Mar 2020
  • creditDaniel Hoffmann of usd AG

Introduced: 16 Mar 2020

CVE-2019-19210  (opens in a new tab)
CWE-94  (opens in a new tab)

How to fix?

Upgrade dolibarr/dolibarr to version 10.0.3 or higher.

Overview

dolibarr/dolibarr is a modern and easy to use web software to manage your business.

Affected versions of this package are vulnerable to Cross-site Scripting (XSS). Uploaded HTML documents are served as text/html despite being renamed to .noexe files.

CVSS Scores

version 3.1