CVE-2020-11823: Dolibarr stored Cross-site Scripting vulnerability
Summary
CVE-2020-11823: Dolibarr stored Cross-site Scripting vulnerability. Affects dolibarr/dolibarr versions 10.0.6. No fix is published. How to fix ↓
Also tracked for
- dolibarr · Bitnami
The same CVE-2020-11823 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Dolibarr is an open-source ERP and CRM software package designed for small and medium-sized businesses. It provides a range of features including accounting, inventory management, project management, and more. Dolibarr is widely used for its user-friendly interface and extensive customization options. However, version 10.0.6 of Dolibarr is vulnerable to a stored Cross-site Scripting (XSS) attack on the admin tools audit page. This vulnerability, identified as CVE-2020-11823, allows an attacker to execute malicious scripts and potentially steal the admin account.
Vulnerability Detail
The stored XSS vulnerability in Dolibarr 10.0.6 occurs when the USER_LOGIN_FAILED feature is active. Attackers can exploit this vulnerability by injecting malicious scripts into the admin tools audit page. When an admin user accesses this page, the injected script is executed, allowing the attacker to perform various actions on behalf of the admin, including stealing sensitive information. The severity of this vulnerability is considered moderate, with a CVSS score of 5.4.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can disable the USER_LOGIN_FAILED feature in Dolibarr to mitigate the risk of exploitation. This can be done by modifying the application configuration or disabling the corresponding module. However, this workaround may impact the functionality of the application and should only be considered as a temporary measure until the vulnerability is properly patched.
Conclusion
In conclusion, Dolibarr version 10.0.6 is vulnerable to a stored XSS attack on the admin tools audit page. This vulnerability, identified as CVE-2020-11823, allows an attacker to execute malicious scripts and potentially steal the admin account. Users are advised to upgrade to a patched version of Dolibarr and review their security settings to mitigate the risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for dolibarr/dolibarr →
FAQ
Dolibarr is an open-source ERP and CRM software package designed for small and medium-sized businesses. It offers various features including accounting, inventory management, and project management.
A stored XSS vulnerability allows an attacker to inject malicious scripts into a web application, which are then stored and executed when accessed by other users. This can lead to various security risks, including data theft and unauthorized actions.
An attacker can exploit the stored XSS vulnerability in Dolibarr by injecting malicious scripts into the admin tools audit page. When an admin user accesses this page, the injected script is executed, allowing the attacker to perform actions on behalf of the admin.
The severity of this vulnerability is considered moderate, with a CVSS score of 5.4. While it is not the highest level of severity, it still poses a significant risk and should be addressed promptly.
To fix this vulnerability, it is recommended to upgrade to a patched version of Dolibarr. Users should update their Dolibarr installation to the latest version available and review their security settings to minimize the risk of similar vulnerabilities.
Related vulnerabilities
Recent vulnerabilities recorded for dolibarr/dolibarr.
