PT-2015-6349 · Dolibarr · Dolibarr Erp/Crm

Naxonezo · Publicado 2015-06-10 · Atualizado 2022-05-17 · CVE-2015-3935

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Dolibarr ERP/CRM versions 3.5 through 3.6

Description The issue allows remote attackers to inject arbitrary web script or HTML via the Business Search (search nom) field to (1) htdocs/societe/societe.php or (2) htdocs/societe/admin/societe.php. This enables attackers to execute malicious scripts on the victim's browser.

Recommendations For Dolibarr ERP/CRM versions 3.5 through 3.6, consider disabling the Business Search (search nom) field until a patch is available to prevent exploitation. Restrict access to the htdocs/societe/societe.php and htdocs/societe/admin/societe.php endpoints to minimize the risk of exploitation. Avoid using the search nom field in the affected API endpoints until the issue is resolved.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2015-3935

GHSA-6FW8-VF2X-4WPM

Produtos afetados

Dolibarr Erp/Crm

Referências · 15

• 🔥 https://github.com/Dolibarr/dolibarr/issues/2857 · Exploit
• 🔥 http://seclists.org/fulldisclosure/2015/May/126 · Exploit
• 🔥 http://packetstormsecurity.com/files/132108/Dolibarr-3.5-3.6-HTML-Injection.html · Exploit
• https://github.com/dolibarr/dolibarr/commit/a7f6bbd316e9b96216e9b2c7a065c9251c9a8907 · Nota
• https://github.com/Dolibarr/dolibarr/issues/4291 · Nota
• https://github.com/Dolibarr/dolibarr/issues/4341 · Nota
• https://github.com/Dolibarr/dolibarr/pull/2866 · Nota
• https://github.com/GPCsolutions/dolibarr/commit/a7f6bbd316e9b96216e9b2c7a065c9251c9a8907 · Nota
• https://osv.dev/vulnerability/UBUNTU-CVE-2015-3935 · Aviso do Fabricante
• http://securityfocus.com/bid/74926 · Nota
• https://ubuntu.com/security/CVE-2015-3935 · Aviso do Fabricante
• https://web.archive.org/web/20210122162903/http://securityfocus.com/bid/74926 · Nota
• https://cve.org/CVERecord?id=CVE-2015-3935 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-6fw8-vf2x-4wpm · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2015-3935 · Nota de Segurança