PT-2019-14772 · Dolibarr · Dolibarr

Published 2019-09-27 · Updated 2022-11-17 · CVE-2019-16688

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Dolibarr version 9.0.5

Description The issue concerns a stored XSS in the Email Template section, specifically affecting the mails templates.php file. This allows a user, regardless of their privileges, to inject scripts that can attack the admin, potentially impacting all types of user privileges, from administrators to users with no permissions.

Recommendations For Dolibarr version 9.0.5, consider restricting access to the Email Template section and the mails templates.php file until a fix is available. As a temporary workaround, avoid using the Email Template section to prevent potential script injections.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2019-16688

GHSA-9H46-G4C9-7976

Affected Products

Dolibarr

References · 8

• 🔥 http://verneet.com/cve-2019-16688 · Exploit
• https://cve.org/CVERecord?id=CVE-2019-16688 · Security Note
• https://osv.dev/vulnerability/GHSA-9h46-g4c9-7976 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-16688 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2019-16688 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-16688 · Security Note
• https://osv.dev/vulnerability/CVE-2019-16688 · Vendor Advisory
• https://github.com/Dolibarr/dolibarr · Note