PT-2020-13709 · Dolibarr · Dolibarr

Luis Noriega · Published 2020-08-31 · Updated 2025-04-03 · CVE-2020-13828

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Dolibarr version 11.0.4

Description The issue concerns multiple stored Cross-Site Scripting (XSS) vulnerabilities. These could allow remote authenticated attackers to inject arbitrary web script or HTML. This can be done via several API endpoints, including "ticket/card.php?action=create" with the subject, message, or address parameter, "adherents/card.php" with the societe or address parameter, "product/card.php" with the label or customcode parameter, or "societe/card.php" with the alias or barcode parameter.

Recommendations For Dolibarr version 11.0.4, update to a version that includes a fix for these stored XSS vulnerabilities. As a temporary workaround, consider restricting access to the affected API endpoints, such as "ticket/card.php?action=create", "adherents/card.php", "product/card.php", and "societe/card.php", to minimize the risk of exploitation. Additionally, limit the use of vulnerable parameters like subject, message, address, societe, label, customcode, alias, and barcode in these endpoints until a patch is available.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BIT-DOLIBARR-2020-13828

CVE-2020-13828

GHSA-8R2W-PHX4-MGPV

Affected Products

Dolibarr

References · 9

• https://osv.dev/vulnerability/CVE-2020-13828 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2020-13828 · Security Note
• https://wizlynxgroup.com/security-research-advisories/vuln/WLX-2020-002 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-13828 · Security Note
• https://ubuntu.com/security/CVE-2020-13828 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-dolibarr-2020-13828 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-13828 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-8r2w-phx4-mgpv · Vendor Advisory
• https://github.com/Dolibarr/dolibarr · Note