CVE-2018-19995

A stored cross-site scripting (XSS) vulnerability in Dolibarr 8.0.2 allows remote authenticated users to inject arbitrary web script or HTML via the "address" (POST) or "town" (POST) parameter to user/card.php.

References

Affected packages

Git / github.com/dolibarr/dolibarr

Affected ranges

Type

GIT

Repo

https://github.com/dolibarr/dolibarr

Events

Introduced

85180b117c86ca8a3a2639e5d484711d7c76b494

Last Affected

85180b117c86ca8a3a2639e5d484711d7c76b494

Fixed

4b8be6ed64763327018ac1c076f81ddffa87855e

Fixed

bacd5110fbdc81a35030fdc322775fa15ea85924

Database specific

Show details

{
    "extracted_events": [
        {
            "cpe": "cpe:2.3:a:dolibarr:dolibarr_erp\\/crm:8.0.2:*:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "8.0.2"
                },
                {
                    "last_affected": "8.0.2"
                }
            ],
            "source": "CPE_STRING"
        },
        {
            "range": [
                {
                    "fixed": "4b8be6ed64763327018ac1c076f81ddffa87855e"
                }
            ],
            "source": "REFERENCES_COMMIT"
        },
        {
            "range": [
                {
                    "fixed": "bacd5110fbdc81a35030fdc322775fa15ea85924"
                }
            ],
            "source": "REFERENCES_COMMIT"
        }
    ]
}

Affected versions

8.*

8.0.2

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2018-19995.json"