CVE-2018-19992: Dolibarr stored cross-site scripting (XSS) vulnerability
Summary
CVE-2018-19992: Dolibarr stored cross-site scripting (XSS) vulnerability. Affects dolibarr/dolibarr versions < 8.0.4. Fixed in 8.0.4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Dolibarr is an open-source ERP and CRM software package that provides various features for managing business processes. It is widely used for its flexibility, ease of use, and extensive functionality. However, Dolibarr versions up to 8.0.2 are vulnerable to a stored cross-site scripting (XSS) attack. This vulnerability allows remote authenticated users to inject arbitrary web script or HTML via the 'address' or 'town' parameter in the adherents/type.php file.
Vulnerability Detail
The stored cross-site scripting (XSS) vulnerability in Dolibarr 8.0.2 enables remote authenticated users to inject malicious web scripts or HTML code. By exploiting this vulnerability, an attacker can execute arbitrary code in the context of other users, potentially leading to session hijacking, data theft, or unauthorized actions. The vulnerability originates from inadequate input sanitization and validation of user-supplied data in the 'address' and 'town' parameters of the adherents/type.php file.
How To Fix
Minimum fixed version
8.0.4
This is the first release that contains the fix.
composer require dolibarr/dolibarr:8.0.4Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version is not immediately feasible, a temporary workaround can be implemented by applying input validation and sanitization measures to the 'address' and 'town' parameters in the adherents/type.php file. This can be achieved by using appropriate security libraries or functions to filter and sanitize user input, ensuring that any potentially malicious code is neutralized.
Conclusion
The stored cross-site scripting (XSS) vulnerability in Dolibarr 8.0.2 poses a moderate security risk, allowing remote authenticated users to inject malicious web scripts or HTML code. To mitigate this vulnerability, it is crucial to upgrade Dolibarr to version 8.0.4 or later. Alternatively, implementing input validation and sanitization measures can provide temporary protection. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for dolibarr/dolibarr →
FAQ
Dolibarr is an open-source ERP and CRM software package that provides various features for managing business processes.
A stored cross-site scripting (XSS) vulnerability is a type of security flaw that allows an attacker to inject malicious scripts or HTML code into a vulnerable application. In the case of Dolibarr, this vulnerability enables remote authenticated users to inject such code via the 'address' or 'town' parameters.
Exploiting this vulnerability can lead to various security risks, including session hijacking, data theft, and unauthorized actions. An attacker could execute arbitrary code in the context of other users, potentially compromising sensitive information or performing malicious activities.
To fix this vulnerability, it is recommended to upgrade Dolibarr to version 8.0.4 or later. This version includes patches and security enhancements that address the specific XSS vulnerability. Alternatively, you can apply input validation and sanitization measures to the affected parameters in the adherents/type.php file.
For more information about this vulnerability, you can refer to the official Dolibarr security advisory or the CVE entry (CVE-2018-19992). Additionally, you can use vulnerability monitoring services like Vulert to stay informed about open-source vulnerabilities in your software.
References
Related vulnerabilities
Recent vulnerabilities recorded for dolibarr/dolibarr.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
