CVE-2023-38888: XSS
Cross Site Scripting vulnerability in Dolibarr ERP CRM v.17.0.1 and before allows a remote attacker to obtain sensitive information and execute arbitrary code via the REST API module, related to analyseVarsForSqlAndScriptsInjection and testSqlAndScriptInject.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/dolibarr/dolibarrto a version that resolves this vulnerability.Fixed in 17.0.1
Event History
Frequently Asked Questions
What is the vulnerability ID for this Dolibarr ERP CRM vulnerability?
The vulnerability ID for this Dolibarr ERP CRM vulnerability is CVE-2023-38888.
What is the severity of CVE-2023-38888?
The severity of CVE-2023-38888 is critical with a CVSS score of 9.6.
How does the Dolibarr ERP CRM vulnerability CVE-2023-38888 work?
The Dolibarr ERP CRM vulnerability CVE-2023-38888 is a Cross-Site Scripting (XSS) vulnerability that allows a remote attacker to obtain sensitive information and execute arbitrary code via the REST API module.
Which versions of Dolibarr ERP CRM are affected by CVE-2023-38888?
Dolibarr ERP CRM v.17.0.1 and earlier versions are affected by CVE-2023-38888.
How can I fix the Dolibarr ERP CRM vulnerability CVE-2023-38888?
To fix the Dolibarr ERP CRM vulnerability CVE-2023-38888, update to version 17.0.1 or later.