PT-2023-26668 · Unknown · Dolibarr Erp/Crm

Published 2023-09-19 · Updated 2025-04-03 · CVE-2023-38888

Positive Technologies (AI Summary)

CVSS v3.1

9.6

Critical

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Dolibarr ERP CRM versions 17.0.1 and earlier

Description The issue allows a remote attacker to obtain sensitive information and execute arbitrary code via the REST API module. This is related to analyseVarsForSqlAndScriptsInjection and testSqlAndScriptInject.

Recommendations For versions 17.0.1 and earlier, update to a version later than 17.0.1 to resolve the issue. As a temporary workaround, consider restricting access to the REST API module until a patch is available. Avoid using the analyseVarsForSqlAndScriptsInjection and testSqlAndScriptInject functions in the REST API module until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BIT-DOLIBARR-2023-38888

CVE-2023-38888

GHSA-62WF-H26V-5M57

Affected Products

Dolibarr Erp/Crm

References · 14

• 🔥 https://akerva.com/wp-content/uploads/2023/09/AKERVA_Security-Advisory_CVE-2023-38888_Dolibarr_XSS.pdf · Exploit
• https://osv.dev/vulnerability/GHSA-62wf-h26v-5m57 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-38888 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2023-38888 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-38888 · Security Note
• https://ubuntu.com/security/CVE-2023-38888 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-38888 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-dolibarr-2023-38888 · Vendor Advisory
• https://github.com/Dolibarr/dolibarr · Note
• https://t.me/cvenotify/58156 · Telegram Post
• http://dolibarr.com · Note
• https://t.me/cvenotify/58109 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1704373364029088080 · Twitter Post
• https://twitter.com/CVEnew/status/1704299970944254073 · Twitter Post