PT-2019-15782 · Dolibarr · Dolibarr Erp/Crm

CVE-2019-19206 · Publicado 2019-11-26 · Atualizado 2022-11-17

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Média

Vetor base

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Dolibarr CRM/ERP version 10.0.3

Description The issue allows for Stored XSS due to JavaScript execution in an SVG image used for a profile picture. This is specifically related to the "viewimage.php?file=" endpoint, where an attacker can execute JavaScript code within an SVG image.

Recommendations For version 10.0.3, consider disabling the use of SVG images for profile pictures or restrict access to the "viewimage.php?file=" endpoint until a patch is available. Avoid using this endpoint with untrusted input to minimize the risk of exploitation.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2019-19206

GHSA-F6H3-66XR-HQR2

Produtos afetados

Dolibarr Erp/Crm

Referências · 10

• https://github.com/Dolibarr/dolibarr · Nota
• https://medium.com/%40k43p/cve-2019-19206-stored-xss-due-to-javascript-execution-in-an-svg-file-ee1d038fba76 · Nota
• https://osv.dev/vulnerability/CVE-2019-19206 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-19206 · Nota de Segurança
• https://osv.dev/vulnerability/UBUNTU-CVE-2019-19206 · Aviso do Fabricante
• https://dolibarr.org/forum/dolibarr-changelogs · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-f6h3-66xr-hqr2 · Aviso do Fabricante
• https://medium.com/@k43p/cve-2019-19206-stored-xss-due-to-javascript-execution-in-an-svg-file-ee1d038fba76 · Nota
• https://cve.org/CVERecord?id=CVE-2019-19206 · Nota de Segurança
• https://ubuntu.com/security/CVE-2019-19206 · Aviso do Fabricante