GHSA-fc6h-769x-gff5

Dolibarr ERP and CRM contain XSS Vulnerability

Source: GitHub Advisory Database (reviewed) Moderate CVE-2021-33618

Packages

Ecosystem	Package	Affected	Fixed in
Packagist	dolibarr/dolibarr	<= 13.0.2	no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

Dolibarr ERP and CRM 13.0.2 allows XSS via object details, as demonstrated by > and < characters in the onpointermove attribute of a BODY element to the user-management feature.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2021-33618 advisory
https://github.com/Dolibarr/dolibarr/releases web
https://trovent.github.io/security-advisories/TRSA-2105-02/TRSA-2105-02.txt web
https://trovent.io/security-advisory-2105-02 web
http://seclists.org/fulldisclosure/2021/Nov/38 web