CVE-2019-16686: Dolibarr Cross-site Scripting in User Note Section
Summary
CVE-2019-16686: Dolibarr Cross-site Scripting in a User Note section. Affects dolibarr/dolibarr versions 9.0.5. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Dolibarr is an open-source ERP and CRM software package that provides various functionalities for managing business processes. It is widely used for its flexibility, ease of use, and extensive features. However, Dolibarr version 9.0.5 is vulnerable to a stored cross-site scripting (XSS) attack in the User Note section of the note.php file. This vulnerability allows an attacker with no privileges to inject malicious scripts, potentially compromising the admin.
Vulnerability Detail
The stored XSS vulnerability in Dolibarr version 9.0.5 arises from insufficient input sanitization in the User Note section. An attacker can exploit this by injecting malicious scripts into the note field, which are then stored and executed when viewed by other users. This can lead to various consequences, including unauthorized access, session hijacking, and data theft. The vulnerability has a CVSS score of 5.4, indicating a moderate severity level.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can disable the User Note section or restrict access to it until the vulnerability is patched. This can be achieved by modifying the application's configuration or permissions settings. However, it is strongly advised to apply the official fix as soon as possible to ensure comprehensive security.
Conclusion
Dolibarr version 9.0.5 is vulnerable to a stored XSS attack in the User Note section, allowing an attacker to inject malicious scripts. To mitigate this risk, it is recommended to upgrade to a patched version of Dolibarr and implement proper input validation and output encoding. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for dolibarr/dolibarr →
FAQ
Dolibarr is an open-source ERP and CRM software package that helps businesses manage various processes, including sales, inventory, and customer relationships.
A stored XSS vulnerability allows an attacker to inject malicious scripts into a web application, which are then stored and executed when viewed by other users. This can lead to unauthorized access, data theft, and other security breaches.
An attacker with no privileges can exploit the vulnerability by injecting malicious scripts into the User Note section of Dolibarr. When other users view the notes, the scripts are executed, potentially compromising their sessions and sensitive data.
The vulnerability has a CVSS score of 5.4, indicating a moderate severity level. While it is not the highest severity, it still poses a significant risk and should be addressed promptly.
To protect your Dolibarr installation, it is crucial to update to a patched version that addresses the XSS vulnerability. Additionally, implementing input validation and output encoding techniques can help prevent similar attacks in the future.
References
Related vulnerabilities
Recent vulnerabilities recorded for dolibarr/dolibarr.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
