GHSA-62wf-h26v-5m57

Cross Site Scripting vulnerability in Dolibarr ERP CRM

Source: GitHub Advisory Database (reviewed) Critical CVE-2023-38888

Packages

Ecosystem	Package	Affected	Fixed in
Packagist	dolibarr/dolibarr	< 17.0.1	17.0.1

Details

As written in the advisory (Markdown source, shown as plain text).

Cross Site Scripting vulnerability in Dolibarr ERP CRM v.17.0.1 and before allows a remote attacker to obtain sensitive information and execute arbitrary code via the REST API module, related to analyseVarsForSqlAndScriptsInjection and testSqlAndScriptInject.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2023-38888 advisory
https://akerva.com/wp-content/uploads/2023/09/AKERVA_Security-Advisory_CVE-2023-38888_Dolibarr_XSS.pdf web
https://github.com/Dolibarr/dolibarr package
http://dolibarr.com web