CVE-2016-1912: XSS
Published Jan 15, 2016
·Updated
Multiple cross-site scripting (XSS) vulnerabilities in Dolibarr ERP/CRM 3.8.3 allow remote authenticated users to inject arbitrary web script or HTML via the (1) lastname, (2) firstname, (3) email, (4) job, or (5) signature parameter to htdocs/user/card.php.
Affected Software
2 affected components
composer/dolibarr/dolibarr<=3.8.3
dolibarr Dolibarr<=3.8.2
Event History
Jan 15, 2016
CVE Published
via MITRE·08:00 PM
Data Sourced
via MITRE·08:00 PM
Description
May 17, 2022
Advisory Published
03:59 AM
Frequently Asked Questions
1
What is the severity of CVE-2016-1912?
CVE-2016-1912 has a medium severity rating due to its potential for cross-site scripting attacks.
2
How do I fix CVE-2016-1912?
To fix CVE-2016-1912, upgrade to Dolibarr ERP/CRM version 3.8.4 or later.
3
Who is affected by CVE-2016-1912?
CVE-2016-1912 affects Dolibarr ERP/CRM versions up to 3.8.3.
4
What types of attacks are possible with CVE-2016-1912?
CVE-2016-1912 allows for remote authenticated users to execute arbitrary web scripts or HTML.
5
What parameters are involved in CVE-2016-1912?
CVE-2016-1912 involves XSS vulnerabilities through the lastname, firstname, email, job, and signature parameters.