CVE-2023-38888: XSS
First published: Wed Sep 20 2023(Updated: )
Cross Site Scripting vulnerability in Dolibarr ERP CRM v.17.0.1 and before allows a remote attacker to obtain sensitive information and execute arbitrary code via the REST API module, related to analyseVarsForSqlAndScriptsInjection and testSqlAndScriptInject.
Credit: cve@mitre.org cve@mitre.org cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Dolibarr Dolibarr Erp\/crm | <=17.0.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the vulnerability ID for this Dolibarr ERP CRM vulnerability?
The vulnerability ID for this Dolibarr ERP CRM vulnerability is CVE-2023-38888.
What is the severity of CVE-2023-38888?
The severity of CVE-2023-38888 is critical with a CVSS score of 9.6.
How does the Dolibarr ERP CRM vulnerability CVE-2023-38888 work?
The Dolibarr ERP CRM vulnerability CVE-2023-38888 is a Cross-Site Scripting (XSS) vulnerability that allows a remote attacker to obtain sensitive information and execute arbitrary code via the REST API module.
Which versions of Dolibarr ERP CRM are affected by CVE-2023-38888?
Dolibarr ERP CRM v.17.0.1 and earlier versions are affected by CVE-2023-38888.
How can I fix the Dolibarr ERP CRM vulnerability CVE-2023-38888?
To fix the Dolibarr ERP CRM vulnerability CVE-2023-38888, update to version 17.0.1 or later.
- collector/nvd-api
- collector/nvd-index
- collector/nvd-cve
- collector/github-advisory-latest
- alias/GHSA-62wf-h26v-5m57
- alias/CVE-2023-38888
- collector/github-advisory
- agent/type
- agent/event
- agent/author
- agent/first-publish-date
- agent/weakness
- agent/description
- agent/severity
- agent/last-modified-date
- agent/references
- agent/softwarecombine
- agent/tags
- collector/mitre-cve
- source/MITRE
- vendor/dolibarr
- canonical/dolibarr dolibarr erp\/crm
- version/dolibarr dolibarr erp\/crm/17.0.1
- package-manager/composer