PT-2019-15782 · Dolibarr · Dolibarr Erp/Crm

CVE-2019-19206 · Published 2019-11-26 · Updated 2022-11-17

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Dolibarr CRM/ERP version 10.0.3

Description The issue allows for Stored XSS due to JavaScript execution in an SVG image used for a profile picture. This is specifically related to the "viewimage.php?file=" endpoint, where an attacker can execute JavaScript code within an SVG image.

Recommendations For version 10.0.3, consider disabling the use of SVG images for profile pictures or restrict access to the "viewimage.php?file=" endpoint until a patch is available. Avoid using this endpoint with untrusted input to minimize the risk of exploitation.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2019-19206

GHSA-F6H3-66XR-HQR2

Affected Products

Dolibarr Erp/Crm

References · 10

• https://osv.dev/vulnerability/CVE-2019-19206 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-19206 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2019-19206 · Vendor Advisory
• https://dolibarr.org/forum/dolibarr-changelogs · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-f6h3-66xr-hqr2 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2019-19206 · Security Note
• https://ubuntu.com/security/CVE-2019-19206 · Vendor Advisory
• https://github.com/Dolibarr/dolibarr · Note
• https://medium.com/%40k43p/cve-2019-19206-stored-xss-due-to-javascript-execution-in-an-svg-file-ee1d038fba76 · Note
• https://medium.com/@k43p/cve-2019-19206-stored-xss-due-to-javascript-execution-in-an-svg-file-ee1d038fba76 · Note