PT-2020-12872 · Dolibarr · Dolibarr

Published 2020-04-16 · Updated 2025-04-03 · CVE-2020-11823

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Dolibarr version 10.0.6

Description A stored XSS issue exists in the admin tools --> audit page when the USER LOGIN FAILED feature is active. This could potentially allow for the theft of an admin account.

Recommendations For Dolibarr version 10.0.6, consider disabling the USER LOGIN FAILED feature as a temporary workaround until a patch is available. Restrict access to the admin tools --> audit page to minimize the risk of exploitation.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BIT-DOLIBARR-2020-11823

CVE-2020-11823

GHSA-Q938-82FW-WFCF

Affected Products

Dolibarr

References · 9

• 🔥 https://fatihhcelik.blogspot.com/2020/04/dolibarr-stored-xss.html · Exploit
• https://ubuntu.com/security/CVE-2020-11823 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-11823 · Security Note
• https://osv.dev/vulnerability/BIT-dolibarr-2020-11823 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2020-11823 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-11823 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-11823 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-q938-82fw-wfcf · Vendor Advisory
• https://github.com/Dolibarr/dolibarr · Note