CVE-2020-7994: Dolibarr XSS Vulnerabilities in Version 10.0.6
Summary
CVE-2020-7994: Multiple cross-site scripting (XSS) vulnerabilities in Dolibarr 10.0.6 allow remote attackers to inject arbitrary web script or HTML via the (1) label[libelle] parameter to the /htdocs/admin/dict.php?id=3 page; the (2) n... Affects dolibarr versions >= 10.0.6, <= 10.0.6. No fix is published. How to fix ↓
Also tracked for
- dolibarr/dolibarr · Packagist
The same CVE-2020-7994 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Dolibarr is an open-source ERP and CRM software designed for small and medium businesses. It provides a suite of tools for managing various business processes, including invoicing, project management, and customer relationship management. The software is modular, allowing users to enable only the features they need. However, version 10.0.6 has been identified to contain multiple cross-site scripting (XSS) vulnerabilities that can be exploited by attackers.
Vulnerability Detail
Multiple cross-site scripting (XSS) vulnerabilities exist in Dolibarr version 10.0.6. These vulnerabilities allow remote attackers to inject arbitrary web scripts or HTML into the application through various parameters, including label, name, note, zip, email, url, key, and main parameters. The exploitation of these vulnerabilities can lead to unauthorized actions, data theft, or the execution of malicious scripts in the context of the user's session.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can implement input validation and sanitization for the affected parameters to mitigate the risk of XSS attacks. This can be done by encoding user inputs before displaying them on the web pages.
Conclusion
The vulnerabilities identified in Dolibarr version 10.0.6 pose significant security risks due to the potential for XSS attacks. It is crucial for users to update their installations to the latest version to mitigate these risks. Additionally, implementing workarounds can provide temporary relief until a full update can be performed.
See every vulnerability recorded for dolibarr →
FAQ
CVE-2020-7994 is a vulnerability identifier for multiple cross-site scripting (XSS) vulnerabilities found in Dolibarr version 10.0.6.
You can check if your installation is affected by using the Vulert playground at Vulert Scanner, which allows you to monitor and alert for open-source vulnerabilities without needing to sign up.
The risks include unauthorized access to user accounts, data theft, and the potential execution of malicious scripts that can compromise user security.
Yes, users are advised to update to the latest version of Dolibarr that addresses these vulnerabilities.
If immediate updates are not possible, implement input validation and sanitization for the affected parameters as a temporary measure to reduce the risk of exploitation.
Related vulnerabilities
Recent vulnerabilities recorded for dolibarr.
