PT-2019-9375 · Dolibarr · Dolibarr

Chqrly + 2 · Published 2019-03-07 · Updated 2022-05-14 · CVE-2018-16808

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Dolibarr versions prior to 7.0.1

Description The issue concerns Stored XSS in the expense reports plugin. It occurs via the comments parameter, or a public or private note, in the expensereport/card.php file.

Recommendations For versions prior to 7.0.1, update to version 7.0.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the expensereport/card.php file or disabling the expense reports plugin until a patch is available. Avoid using the comments parameter in the affected plugin until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2018-16808

GHSA-R3R5-FQFM-9WRH

Affected Products

Dolibarr

References · 8

• 🔥 https://github.com/Dolibarr/dolibarr/issues/9449 · Exploit
• https://osv.dev/vulnerability/CVE-2018-16808 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2018-16808 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2018-16808 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2018-16808 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-16808 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-r3r5-fqfm-9wrh · Vendor Advisory
• https://github.com/Dolibarr/dolibarr · Note