~ / search / GHSA-fvf9-2hjp-w936

GHSA-fvf9-2hjp-w936

Dolibarr Stored Cross-site Scripting via file upload

Source: GitHub Advisory Database (reviewed) Moderate CVE-2020-13239

Packages

EcosystemPackageAffectedFixed in
Packagist dolibarr/dolibarr 11.0.4 no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

The DMS/ECM module in Dolibarr 11.0.4 renders user-uploaded .html files in the browser when the attachment parameter is removed from the direct download link. This causes XSS.

References

External links from the advisory. They lead to third-party sites.