Multiple vulnerabilities in Dolibarr



Published: 2019-09-30
Risk Low
Patch available YES
Number of vulnerabilities 4
CVE-ID CVE-2019-16685
CVE-2019-16686
CVE-2019-16687
CVE-2019-16688
CWE-ID CWE-79
Exploitation vector Network
Public exploit Public exploit code for vulnerability #1 is available.
Public exploit code for vulnerability #2 is available.
Public exploit code for vulnerability #3 is available.
Public exploit code for vulnerability #4 is available.
Vulnerable software
Subscribe
dolibarr
Web applications / CRM systems

Vendor Dolibarr ERP & CRM

Security Bulletin

This security bulletin contains information about 4 vulnerabilities.

1) Stored cross-site scripting

EUVDB-ID: #VU21424

Risk: Low

CVSSv3.1:

CVE-ID: CVE-2019-16685

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

Description

The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data in User Group Description section (card.php). A remote authenticated attacker with "Create/modify other users, groups and permissions" privilege can permanently inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Mitigation

Install update from vendor's website.

Vulnerable software versions

dolibarr: 9.0.5


CPE2.3 External links

http://verneet.com/cve-2019-16685/

Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?

2) Stored cross-site scripting

EUVDB-ID: #VU21423

Risk: Low

CVSSv3.1:

CVE-ID: CVE-2019-16686

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

Description

The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data in User Note section(note.php). A remote attacker can permanently inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Mitigation

Install update from vendor's website.

Vulnerable software versions

dolibarr: 9.0.5


CPE2.3 External links

http://verneet.com/cve-2019-16686

Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?

3) Stored cross-site scripting

EUVDB-ID: #VU21422

Risk: Low

CVSSv3.1:

CVE-ID: CVE-2019-16687

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

Description

The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data in an Signature section(card.php). A remote authenticated attacker with “Create/modify other users, groups and permissions” privilege can permanently inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Mitigation

Install update from vendor's website.

Vulnerable software versions

dolibarr: 9.0.5


CPE2.3 External links

http://verneet.com/cve-2019-16687

Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?

4) Stored cross-site scripting

EUVDB-ID: #VU21421

Risk: Low

CVSSv3.1:

CVE-ID: CVE-2019-16688

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

Description

The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data in an Email Template section. A remote attacker can permanently inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Mitigation

Install update from vendor's website.

Vulnerable software versions

dolibarr: 9.0.5


CPE2.3 External links

http://verneet.com/cve-2019-16688

Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?



###SIDEBAR###