PT-2011-5120 · Dolibarr · Dolibarr
CVE-2011-4814
·
Publicado
2011-12-14
·
Atualizado
2023-02-10
CVSS v2.0
4.3
Média
| Vetor | AV:N/AC:M/Au:N/C:N/I:P/A:N |
Name of the Vulnerable Software and Affected Versions
Dolibarr versions 3.1.0 RC and earlier
Description
The issue allows remote attackers to inject arbitrary web script or HTML, potentially leading to cross-site scripting (XSS) attacks. This can be achieved by manipulating the PATH INFO to specific API endpoints, such as "index.php", "admin/boxes.php", "comm/clients.php", and "commande/index.php". Additionally, the
optioncss parameter in "admin/ihm.php" and "user/home.php" can be exploited.Recommendations
For Dolibarr versions 3.1.0 RC and earlier, consider restricting access to the vulnerable API endpoints "index.php", "admin/boxes.php", "comm/clients.php", and "commande/index.php" until a patch is available. As a temporary workaround, avoid using the
optioncss parameter in "admin/ihm.php" and "user/home.php" to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.Exploit
XSS
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Dolibarr