CVE-2015-8685: XSS
Multiple cross-site scripting (XSS) vulnerabilities in Dolibarr ERP/CRM 3.8.3 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) external calendar url or (2) the bank name field in the "import external calendar" page.
Affected Software
Event History
Frequently Asked Questions
What are the cross-site scripting vulnerabilities in CVE-2015-8685?
CVE-2015-8685 includes multiple cross-site scripting vulnerabilities that allow remote attackers to inject arbitrary web scripts or HTML.
Which versions of Dolibarr are affected by CVE-2015-8685?
CVE-2015-8685 affects Dolibarr ERP/CRM version 3.8.3 and earlier.
How can I mitigate the risks associated with CVE-2015-8685?
To mitigate CVE-2015-8685, users should upgrade to a fixed version of Dolibarr that addresses these vulnerabilities.
What are the specific input fields that allow XSS in CVE-2015-8685?
The vulnerable input fields in CVE-2015-8685 are the external calendar URL and the bank name field in the import external calendar page.
Why is CVE-2015-8685 considered a security risk?
CVE-2015-8685 is a security risk because it allows attackers to execute malicious scripts in the context of users' browsers, potentially leading to data theft or session hijacking.