CVE-2020-14475: Dolibarr reflected cross-site scripting (XSS) vulnerability
Summary
CVE-2020-14475: Dolibarr reflected cross-site scripting (XSS) vulnerability. Affects dolibarr/dolibarr versions < 11.0.5. Fixed in 11.0.5. How to fix ↓
Also tracked for
- dolibarr · Bitnami
The same CVE-2020-14475 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Dolibarr is an open-source ERP and CRM software designed for small and medium-sized businesses. It provides a wide range of features, including customer relationship management, invoicing, inventory management, and more. Dolibarr is widely used for its flexibility and ease of use. However, versions 11.0.4 and below are vulnerable to a reflected cross-site scripting (XSS) attack.
Vulnerability Detail
The vulnerability in Dolibarr allows remote attackers to inject arbitrary web script or HTML into the public/notice.php file. This vulnerability is related to the 'transphrase' and 'transkey' parameters. By exploiting this vulnerability, an attacker can execute malicious code in the context of the victim's browser, potentially leading to session hijacking, data theft, or other forms of attack.
How To Fix
Minimum fixed version
11.0.5
This is the first release that contains the fix.
composer require dolibarr/dolibarr:11.0.5Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version is not immediately possible, a temporary workaround is to disable or restrict access to the public/notice.php file. This can be done by modifying the server configuration or using access control rules. However, this is only a temporary solution, and upgrading to the patched version is strongly advised.
Conclusion
The reflected cross-site scripting (XSS) vulnerability in Dolibarr poses a moderate risk to systems running vulnerable versions. It is crucial to upgrade to version 11.0.5 or above to mitigate the risk of exploitation. For further assistance and support in addressing this vulnerability, please contact DevNack.com.
See every vulnerability recorded for dolibarr/dolibarr →
FAQ
The vulnerability allows attackers to inject malicious code into the Dolibarr application, potentially leading to various attacks such as session hijacking, data theft, or defacement of the application.
No, authentication is not required. The vulnerability can be exploited remotely without any authentication.
No, only versions 11.0.4 and below are affected. Users of later versions are not vulnerable to this specific XSS vulnerability.
At the time of this advisory, there are no known public exploits specifically targeting this vulnerability. However, it is important to patch the vulnerability as soon as possible to prevent any potential attacks.
For more information about the vulnerability, you can refer to the GitHub advisory database at the following link: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-m396-2x3h-v3v4/GHSA-m396-2x3h-v3v4.json
References
Related vulnerabilities
Recent vulnerabilities recorded for dolibarr/dolibarr.
