PT-2021-4130 · Unknown · Dolibarr Erp/Crm
Hagai Wechsler
·
Published
2021-08-15
·
Updated
2022-08-01
·
CVE-2021-25955
CVSS v3.1
9.0
Critical
| Vector | AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Dolibarr ERP CRM versions 2.8.1 through 13.0.2
Description
The issue is related to a stored XSS vulnerability in the WYSIWYG Editor module. This vulnerability allows low-privileged application users to store malicious scripts in the
Private Note field at the "/adherents/note.php?id=1" endpoint. When a victim opens the page containing the vulnerable field, the scripts are executed in their browser. In the worst-case scenario, the victim could be a highly privileged administrator, and the injected scripts can extract the Session ID, leading to full account takeover. Additionally, due to another vulnerability (Improper Access Control on Private notes), a low-privileged user can update private notes, which could lead to privilege escalation.Recommendations
For versions 2.8.1 through 13.0.2, as a temporary workaround, consider disabling the WYSIWYG Editor module until a patch is available. Restrict access to the "/adherents/note.php?id=1" endpoint to minimize the risk of exploitation. Avoid using the
Private Note field in the affected endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.XSS
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Dolibarr Erp/Crm