CVE-2019-17577: Dolibarr Cross-site Scripting via outgoing email setup feature
Summary
CVE-2019-17577: Dolibarr Cross-site Scripting via outgoing email setup feature. Affects dolibarr/dolibarr versions 10.0.2. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Dolibarr is an open-source ERP and CRM software package that provides various functionalities for managing business processes. It is widely used for its flexibility and ease of use. However, Dolibarr version 10.0.2 is found to be vulnerable to a cross-site scripting (XSS) attack through the 'outgoing email setup' feature in the admin/mails.php?action=edit URI. This vulnerability allows an attacker to inject malicious scripts into the 'Email used for error returns emails (fields 'Errors-To' in emails sent)' field, potentially leading to unauthorized access, data theft, or other malicious activities.
Vulnerability Detail
The vulnerability in Dolibarr version 10.0.2 arises from insufficient input sanitization in the 'outgoing email setup' feature. By injecting malicious scripts into the 'Errors-To' field, an attacker can execute arbitrary code within the context of the victim's browser. This can lead to various consequences, including session hijacking, phishing attacks, and unauthorized access to sensitive information. The severity of this vulnerability is rated as MODERATE with a CVSS score of 5.4.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can disable or restrict access to the 'outgoing email setup' feature in Dolibarr to prevent potential exploitation of this vulnerability. This can be achieved by modifying the application's configuration or access control settings. However, this workaround should only be considered as a temporary measure until the software is updated to a patched version.
Conclusion
In conclusion, Dolibarr version 10.0.2 is vulnerable to a cross-site scripting (XSS) attack through the 'outgoing email setup' feature. This can lead to unauthorized access, data theft, and other malicious activities. It is recommended to update Dolibarr to a patched version and regularly apply security updates to mitigate the risk. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for dolibarr/dolibarr →
FAQ
Dolibarr is an open-source ERP and CRM software package that provides various functionalities for managing business processes.
Cross-site scripting (XSS) is a type of security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users.
This vulnerability can be exploited by an attacker who can inject malicious scripts into the 'Errors-To' field of the 'outgoing email setup' feature in Dolibarr.
The potential consequences of this vulnerability include unauthorized access, data theft, session hijacking, and phishing attacks.
To protect your Dolibarr installation, it is crucial to update to the latest patched version and regularly apply security updates. Additionally, implementing secure coding practices and input validation can help mitigate the risk of XSS vulnerabilities.
Related vulnerabilities
Recent vulnerabilities recorded for dolibarr/dolibarr.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
