CVE-2024-55227: Dolibarr Cross-site Scripting Vulnerability in Events/Agenda Module
Summary
CVE-2024-55227: Dolibarr Cross-site Scripting vulnerability. Affects dolibarr/dolibarr versions 21.0.0-beta. No fix is published. How to fix ↓
Also tracked for
- dolibarr · Bitnami
The same CVE-2024-55227 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Dolibarr is an open-source ERP and CRM software designed for small and medium-sized businesses. It provides a range of functionalities including invoicing, project management, and event scheduling. The Events/Agenda module allows users to manage events and agendas effectively. However, a vulnerability in this module exposes users to cross-site scripting (XSS) attacks, potentially compromising the integrity of the application and its users.
Vulnerability Detail
The vulnerability arises from improper validation of user input in the Title parameter of the Events/Agenda module in Dolibarr v21.0.0-beta. Attackers can exploit this flaw by injecting malicious scripts or HTML code, which can then be executed in the context of the user's browser. This could lead to unauthorized actions being performed on behalf of the user, data theft, or session hijacking. The vulnerability is classified as CWE-79, indicating its nature as a cross-site scripting issue.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can sanitize input in the Title parameter before submission. This can be done by implementing input validation to strip out any HTML or script tags. For example, in PHP, you can use the following code: '
htmlspecialchars($title, ENT_QUOTES, 'UTF-8');
' to prevent script execution.
Conclusion
The CVE-2024-55227 vulnerability in Dolibarr's Events/Agenda module poses a significant risk due to its potential for cross-site scripting attacks. Users are strongly encouraged to update their installations to the latest version to mitigate this risk. Additionally, implementing input validation can serve as a temporary measure until the update is completed.
See every vulnerability recorded for dolibarr/dolibarr →
FAQ
The vulnerability allows attackers to execute arbitrary web scripts or HTML in the user's browser, potentially leading to data theft or unauthorized actions.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
Yes, users are advised to update to the latest version of Dolibarr where the vulnerability has been patched.
Implement input validation and sanitization as a temporary workaround to mitigate the risk of exploitation.
Vulert monitors and alerts for open-source vulnerabilities in your software using just the composer.lock file, providing real-time insights without requiring access to the code.
References
Related vulnerabilities
Recent vulnerabilities recorded for dolibarr/dolibarr.
