CVE-2011-4814: XSS
First published: Wed Dec 14 2011(Updated: )
Multiple cross-site scripting (XSS) vulnerabilities in Dolibarr 3.1.0 RC and probably earlier allow remote attackers to inject arbitrary web script or HTML via the PATH_INFO to (1) index.php, (2) admin/boxes.php, (3) comm/clients.php, (4) commande/index.php; and the optioncss parameter to (5) admin/ihm.php and (6) user/home.php.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Dolibarr Dolibarr Erp\/crm | =2.9.0 | |
| Dolibarr Dolibarr Erp\/crm | =2.8.1 | |
| Dolibarr Dolibarr Erp\/crm | <=3.1.0 | |
| Dolibarr Dolibarr Erp\/crm | =2.6.0 | |
| Dolibarr Dolibarr Erp\/crm | =3.0.0 | |
| Dolibarr Dolibarr Erp\/crm | =2.7.1 | |
| Dolibarr Dolibarr Erp\/crm | =2.6.1 | |
| Dolibarr Dolibarr Erp\/crm | =2.5.0 | |
| Dolibarr Dolibarr Erp\/crm | =2.7.0 | |
| Dolibarr Dolibarr Erp\/crm | =2.8.0 | |
| Dolibarr Dolibarr Erp\/crm | =3.0.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://www.osvdb.org/77339
- https://github.com/Dolibarr/dolibarr/commit/d08d28c0cda1f762a47cc205d4363de03df16675
- https://www.htbridge.ch/advisory/multiple_vulnerabilities_in_dolibarr.html
- https://github.com/Dolibarr/dolibarr/commit/c539155d6ac2f5b6ea75b87a16f298c0090e535a
- https://github.com/Dolibarr/dolibarr/commit/63820ab37537fdff842539425b2bf2881f0d8e91
- http://www.securityfocus.com/bid/50777
- https://github.com/Dolibarr/dolibarr/commit/762f98ab4137749d0993612b4e3544a4207e78a1
- http://www.securityfocus.com/archive/1/520619/100/0/threaded
- collector/nvd-historical
- collector/nvd-index
- agent/author
- agent/description
- agent/softwarecombine
- agent/first-publish-date
- agent/last-modified-date
- agent/references
- agent/remedy
- agent/type
- agent/event
- agent/severity
- agent/weakness
- agent/tags
- collector/mitre-cve
- source/MITRE
- vendor/dolibarr
- canonical/dolibarr dolibarr erp\/crm
- version/dolibarr dolibarr erp\/crm/2.9.0
- version/dolibarr dolibarr erp\/crm/2.8.1
- version/dolibarr dolibarr erp\/crm/3.1.0
- version/dolibarr dolibarr erp\/crm/2.6.0
- version/dolibarr dolibarr erp\/crm/3.0.0
- version/dolibarr dolibarr erp\/crm/2.7.1
- version/dolibarr dolibarr erp\/crm/2.6.1
- version/dolibarr dolibarr erp\/crm/2.5.0
- version/dolibarr dolibarr erp\/crm/2.7.0
- version/dolibarr dolibarr erp\/crm/2.8.0
- version/dolibarr dolibarr erp\/crm/3.0.1