PT-2019-9958 · Dolibarr · Dolibarr

Eldy

·

CVE-2018-19993

·

Published

2019-01-03

·

Updated

2022-11-17

CVSS v3.1

6.1

Medium

VectorAV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Name of the Vulnerable Software and Affected Versions Dolibarr version 8.0.2
Description A reflected cross-site scripting issue allows remote attackers to inject arbitrary web script or HTML via the transphrase parameter to the "public/notice.php" endpoint.
Recommendations For Dolibarr version 8.0.2, consider restricting access to the "public/notice.php" endpoint until a patch is available, and avoid using the transphrase parameter in this endpoint to minimize the risk of exploitation.

Fix

XSS

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2018-19993
GHSA-2GC5-3H3P-8VPF

Affected Products

Dolibarr