CVE-2018-10095: XSS
First published: Tue May 22 2018(Updated: )
Cross-site scripting (XSS) vulnerability in Dolibarr before 7.0.2 allows remote attackers to inject arbitrary web script or HTML via the foruserlogin parameter to adherents/cartes/carte.php.
Credit: cve@mitre.org cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Dolibarr Dolibarr | <7.0.2 | |
| composer/dolibarr/dolibarr | <7.0.2 | 7.0.2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://www.openwall.com/lists/oss-security/2018/05/21/3
- https://github.com/Dolibarr/dolibarr/blob/7.0.2/ChangeLog
- https://github.com/Dolibarr/dolibarr/commit/1dc466e1fb687cfe647de4af891720419823ed56
- https://sysdream.com/news/lab/2018-05-21-cve-2018-10095-dolibarr-xss-injection-vulnerability/
- https://nvd.nist.gov/vuln/detail/CVE-2018-10095
- https://sysdream.com/news/lab/2018-05-21-cve-2018-10095-dolibarr-xss-injection-vulnerability
- https://github.com/advisories/GHSA-p2fm-8rhj-58fr (Advisory)
Frequently Asked Questions
What is the severity of CVE-2018-10095?
The severity of CVE-2018-10095 is medium with a severity value of 6.1.
How does CVE-2018-10095 affect Dolibarr?
CVE-2018-10095 affects Dolibarr versions before 7.0.2.
What is the vulnerability in Dolibarr before 7.0.2?
The vulnerability in Dolibarr before 7.0.2 is a cross-site scripting (XSS) vulnerability.
How can remote attackers exploit CVE-2018-10095?
Remote attackers can exploit CVE-2018-10095 by injecting arbitrary web script or HTML using the 'foruserlogin' parameter to 'adherents/cartes/carte.php'.
Are there any references related to CVE-2018-10095?
Yes, you can find references related to CVE-2018-10095 in the following links: [Reference 1](http://www.openwall.com/lists/oss-security/2018/05/21/3), [Reference 2](https://github.com/Dolibarr/dolibarr/blob/7.0.2/ChangeLog), [Reference 3](https://github.com/Dolibarr/dolibarr/commit/1dc466e1fb687cfe647de4af891720419823ed56).
- collector/nvd-index
- agent/type
- agent/first-publish-date
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-p2fm-8rhj-58fr
- alias/CVE-2018-10095
- agent/software-canonical-lookup
- agent/severity
- agent/last-modified-date
- agent/remedy
- agent/references
- agent/weakness
- agent/description
- agent/softwarecombine
- agent/event
- collector/nvd-cve
- source/NVD
- agent/author
- collector/github-advisory
- agent/tags
- collector/mitre-cve
- source/MITRE
- vendor/dolibarr
- canonical/dolibarr dolibarr
- package-manager/composer