CVE-2019-1010016: Dolibarr Cross Site Scripting (XSS)
Summary
CVE-2019-1010016: Dolibarr Cross Site Scripting (XSS). Affects dolibarr/dolibarr versions 6.0.4. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Dolibarr is an open-source ERP and CRM software package that provides a range of features for managing business processes. It is widely used by organizations to streamline their operations and improve efficiency. However, Dolibarr version 6.0.4 is vulnerable to a Cross Site Scripting (XSS) attack in the htdocs/product/stats/card.php component. This vulnerability allows an attacker to steal cookies from the victim's browser, potentially leading to unauthorized access to sensitive information.
Vulnerability Detail
The Cross Site Scripting (XSS) vulnerability in Dolibarr version 6.0.4 arises when a victim clicks on a specially crafted link sent by the attacker. This link contains malicious code that is executed within the victim's browser, allowing the attacker to steal cookies. The stolen cookies can be used to impersonate the victim, leading to potential unauthorized access to their account and sensitive data. The impact of this vulnerability is considered moderate.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. It is advised to apply the fix provided by upgrading to a patched version of Dolibarr.
Conclusion
Dolibarr version 6.0.4 is vulnerable to a Cross Site Scripting (XSS) attack that can lead to cookie stealing and potential unauthorized access to sensitive information. It is recommended to upgrade to a patched version of Dolibarr to mitigate this vulnerability. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for dolibarr/dolibarr →
FAQ
Dolibarr is an open-source ERP and CRM software package that helps organizations manage their business processes efficiently.
Cross Site Scripting (XSS) is a type of security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users.
This vulnerability allows an attacker to steal cookies from the victim's browser, potentially leading to unauthorized access to sensitive information.
Yes, upgrading to a patched version of Dolibarr (beyond 6.0.4) should address this XSS vulnerability.
To protect your Dolibarr installation, it is crucial to keep the software up to date by applying the latest patches and security updates.
References
Related vulnerabilities
Recent vulnerabilities recorded for dolibarr/dolibarr.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
