GHSA-f848-r5g6-6gpf

Source

https://github.com/advisories/GHSA-f848-r5g6-6gpf

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-f848-r5g6-6gpf/GHSA-f848-r5g6-6gpf.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-f848-r5g6-6gpf

Aliases

Published

2022-05-24T17:18:11Z

Modified

2025-04-03T15:27:11Z

Severity

5.4 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N CVSS Calculator

Summary

Dolibarr Stored Cross-site Scripting

Details

The DMS/ECM module in Dolibarr 11.0.4 allows users with the 'Setup documents directories' permission to rename uploaded files to have insecure file extensions. This bypasses the .noexe protection mechanism against XSS.

Database specific

{
    "cwe_ids":  [
        "CWE-276",
        "CWE-668",
        "CWE-79"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2024-04-24T20:35:34Z",
    "nvd_published_at":  "2020-05-20T15:15:00Z",
    "severity":  "MODERATE"
}

References

Affected packages

Packagist / dolibarr/dolibarr

Package

Name: dolibarr/dolibarr
Purl: pkg:composer/dolibarr/dolibarr

Affected ranges

Affected versions

11.*

11.0.4

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-f848-r5g6-6gpf/GHSA-f848-r5g6-6gpf.json"