CVE-2019-16685: Dolibarr stored Cross-site Scripting vulnerability
Summary
CVE-2019-16685: Dolibarr stored Cross-site Scripting vulnerability. Affects dolibarr/dolibarr versions 9.0.5. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Dolibarr is an open-source ERP and CRM software package that provides various functionalities for managing business processes. It is widely used for its user-friendly interface and extensive features, including user and group management. However, Dolibarr version 9.0.5 is susceptible to a stored Cross-site Scripting (XSS) vulnerability.
Vulnerability Detail
The stored XSS vulnerability in Dolibarr version 9.0.5 is present in the User Group Description section of the card.php file. An attacker with the "Create/modify other users, groups and permissions" privilege can exploit this vulnerability by injecting malicious scripts. This can lead to the execution of arbitrary code in the context of other users, potentially resulting in privilege escalation and unauthorized access to sensitive information.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can disable the affected functionality or restrict access to the User Group Description section for users without the necessary privileges. However, this is not a permanent solution and should only be considered until the software is updated to a secure version.
Conclusion
The stored XSS vulnerability in Dolibarr version 9.0.5 poses a moderate risk, allowing for potential privilege escalation and unauthorized access to sensitive information. It is crucial to update Dolibarr to a secure version and regularly apply security patches to mitigate this vulnerability. For further assistance with vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for dolibarr/dolibarr →
FAQ
The stored XSS vulnerability in Dolibarr can allow an attacker to execute arbitrary code in the context of other users, potentially leading to privilege escalation and unauthorized access to sensitive information.
Users of Dolibarr version 9.0.5 are affected by this vulnerability. It is important to update to a secure version to mitigate the risk.
At the time of this advisory, there are no known public exploits specifically targeting this vulnerability. However, it is essential to address the issue promptly to prevent potential exploitation.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your Dolibarr installation is affected by this vulnerability. Simply upload your composer.lock file to the playground, and it will provide real-time alerts for open-source vulnerabilities.
For more information about this vulnerability, you can refer to the Dolibarr GitHub advisory database (https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-fvxr-767j-f28v/GHSA-fvxr-767j-f28v.json).
References
Related vulnerabilities
Recent vulnerabilities recorded for dolibarr/dolibarr.
