PT-2019-14769 · Dolibarr · Dolibarr

Published 2019-09-27 · Updated 2022-11-17 · CVE-2019-16685

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Dolibarr version 9.0.5

Description The issue allows for stored XSS via the User Group Description section in card.php. A user with the "Create/modify other users, groups and permissions" privilege can inject script, potentially achieving privilege escalation.

Recommendations For Dolibarr version 9.0.5, consider restricting access to the User Group Description section in card.php for users with the "Create/modify other users, groups and permissions" privilege until a fix is available. As a temporary workaround, avoid using the User Group Description section in card.php to minimize the risk of exploitation.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2019-16685

GHSA-FVXR-767J-F28V

Affected Products

Dolibarr

References · 8

• 🔥 http://verneet.com/cve-2019-16685 · Exploit
• https://cve.org/CVERecord?id=CVE-2019-16685 · Security Note
• https://ubuntu.com/security/CVE-2019-16685 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-fvxr-767j-f28v · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2019-16685 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-16685 · Security Note
• https://osv.dev/vulnerability/CVE-2019-16685 · Vendor Advisory
• https://github.com/Dolibarr/dolibarr · Note