CVE-2019-16688: Dolibarr stored Cross-site Scripting in an Email Template section
Summary
CVE-2019-16688: Dolibarr stored Cross-site Scripting in an Email Template section. Affects dolibarr/dolibarr versions 9.0.5. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Dolibarr is an open-source ERP and CRM software package that provides various functionalities for managing business processes. It includes features such as invoicing, inventory management, project management, and email communication. Dolibarr version 9.0.5 is affected by a stored cross-site scripting (XSS) vulnerability in the Email Template section of the application. This vulnerability allows an attacker with no privileges to inject malicious scripts into the email templates, potentially leading to attacks against administrators and users with different permission levels.
Vulnerability Detail
The stored XSS vulnerability in Dolibarr version 9.0.5 allows an attacker to inject malicious scripts into the Email Template section of the application. This can be exploited by a user with no privileges to execute arbitrary code in the context of the admin or other users. The vulnerability affects all types of user privileges, from administrators to users with no permissions. The impact of this vulnerability can range from unauthorized access to sensitive information to complete compromise of the affected system.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can disable the affected Email Template section in Dolibarr to prevent potential exploitation of the vulnerability. This can be done by modifying the application configuration or by restricting access to the affected functionality.
Conclusion
The stored XSS vulnerability in Dolibarr version 9.0.5 poses a moderate risk to the security of affected systems. Users are advised to update their Dolibarr installation to the latest version and apply any available security patches. Disabling the affected Email Template section can serve as a temporary workaround. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for dolibarr/dolibarr →
FAQ
Dolibarr is an open-source ERP and CRM software package that provides various functionalities for managing business processes.
A stored XSS vulnerability allows an attacker to inject malicious scripts into a web application, which are then executed by other users who access the affected pages.
All users of Dolibarr version 9.0.5 are affected by this vulnerability, regardless of their user privileges.
An attacker can exploit this vulnerability to execute arbitrary code in the context of the admin or other users, potentially leading to unauthorized access, data leakage, or complete compromise of the affected system.
To mitigate the risk of exploitation, it is recommended to update Dolibarr to the latest patched version and apply any available security updates.
References
Related vulnerabilities
Recent vulnerabilities recorded for dolibarr/dolibarr.
