GHSA-f848-r5g6-6gpf

ghsaUSosv

Dolibarr Stored Cross-site Scripting

view advisory published 2022-05-24Licence: CC-BY-4.0

The DMS/ECM module in Dolibarr 11.0.4 allows users with the 'Setup documents directories' permission to rename uploaded files to have insecure file extensions. This bypasses the .noexe protection mechanism against XSS.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2020-13240US	medium5.4OT elevated	0.70% (53rd)	—	2020-05-20
The DMS/ECM module in Dolibarr 11.0.4 allows users with the 'Setup documents directories' permission to rename uploaded files to have insecure file extensions. This bypasses the .n…

references

External citations — patches, advisories, analysis.

https://github.com/Dolibarr/dolibarrPACKAGE
https://nvd.nist.gov/vuln/detail/CVE-2020-13240ADVISORY
https://www.dubget.com/stored-xss-via-file-upload.htmlWEB

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan