PT-2020-13389 · Dolibarr · Dolibarr

Published 2020-05-20 · Updated 2025-04-03 · CVE-2020-13239

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Dolibarr version 11.0.4

Description The issue concerns the DMS/ECM module, which renders user-uploaded .html files in the browser when the attachment parameter is removed from the direct download link, leading to a Cross-Site Scripting (XSS) issue.

Recommendations For Dolibarr version 11.0.4, consider disabling the rendering of user-uploaded .html files in the browser as a temporary workaround until a patch is available. Restrict access to the DMS/ECM module to minimize the risk of exploitation. Avoid removing the attachment parameter from direct download links for .html files until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BIT-DOLIBARR-2020-13239

CVE-2020-13239

GHSA-FVF9-2HJP-W936

Affected Products

Dolibarr

References · 10

• 🔥 https://dubget.com/stored-xss-via-file-upload.html · Exploit
• https://ubuntu.com/security/CVE-2020-13239 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-13239 · Security Note
• https://cve.org/CVERecord?id=CVE-2020-13239 · Security Note
• https://osv.dev/vulnerability/CVE-2020-13239 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-fvf9-2hjp-w936 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-dolibarr-2020-13239 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-13239 · Vendor Advisory
• https://github.com/Dolibarr/dolibarr · Note
• https://t.me/cvenotify/3944 · Telegram Post