CVE-2021-42220: Dolibarr Cross Site Scripting (XSS) vulnerability
Summary
CVE-2021-42220: Dolibarr Cross Site Scripting (XSS) vulnerability. Affects dolibarr/dolibarr versions < 14.0.3. Fixed in 14.0.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Dolibarr is an open-source ERP and CRM software package that provides a range of features for managing business operations. It is widely used by organizations to streamline their processes, including ticket creation and management. Dolibarr is built on the Packagist ecosystem and can be installed via Composer. However, versions prior to 14.0.3 are susceptible to a Cross Site Scripting (XSS) vulnerability.
Vulnerability Detail
The XSS vulnerability in Dolibarr before version 14.0.3 is present in the ticket creation flow. An attacker can exploit this vulnerability by injecting malicious code into a specific input box. To successfully exploit the vulnerability, the attacker needs administrative privileges to copy the payload into the box. If successfully exploited, this vulnerability can lead to unauthorized access, data theft, or the execution of arbitrary code within the context of the affected user's session.
How To Fix
Minimum fixed version
14.0.3
This is the first release that contains the fix.
composer require dolibarr/dolibarr:14.0.3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to apply the official patch or upgrade to the fixed version as soon as possible to mitigate the risk of exploitation.
Conclusion
The Dolibarr Cross Site Scripting (XSS) vulnerability (CVE-2021-42220) poses a moderate risk to organizations using Dolibarr versions prior to 14.0.3. It is crucial to apply the official patch or upgrade to the fixed version to ensure the security of the application and protect against potential attacks. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for dolibarr/dolibarr →
FAQ
Dolibarr is an open-source ERP and CRM software package that helps organizations manage their business operations efficiently.
Cross Site Scripting (XSS) is a type of security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users. This can lead to unauthorized access, data theft, or the execution of arbitrary code within the context of the affected user's session.
To exploit this vulnerability, an attacker with administrative privileges needs to inject malicious code into a specific input box during the ticket creation process.
If successfully exploited, this vulnerability can lead to unauthorized access, data theft, or the execution of arbitrary code within the context of the affected user's session.
To protect your Dolibarr installation, it is recommended to upgrade to version 14.0.3 or later, which includes a patch for this vulnerability. Regularly updating your software and following security best practices can help mitigate the risk of exploitation.
Related vulnerabilities
Recent vulnerabilities recorded for dolibarr/dolibarr.
