GHSA-f848-r5g6-6gpf

Source

https://github.com/advisories/GHSA-f848-r5g6-6gpf

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-f848-r5g6-6gpf/GHSA-f848-r5g6-6gpf.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-f848-r5g6-6gpf

Aliases

CVE-2020-13240

Published

2022-05-24T17:18:11Z

Modified

2024-04-24T21:01:44.659917Z

Severity

5.4 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N CVSS Calculator

Summary

Dolibarr Stored Cross-site Scripting

Details

The DMS/ECM module in Dolibarr 11.0.4 allows users with the 'Setup documents directories' permission to rename uploaded files to have insecure file extensions. This bypasses the .noexe protection mechanism against XSS.

Database specific

{
    "nvd_published_at": "2020-05-20T15:15:00Z",
    "cwe_ids": [
        "CWE-276",
        "CWE-668",
        "CWE-79"
    ],
    "severity": "MODERATE",
    "github_reviewed": true,
    "github_reviewed_at": "2024-04-24T20:35:34Z"
}

GHSA-f848-r5g6-6gpf

Affected packages

Packagist / dolibarr/dolibarr

Package

Affected ranges

Affected versions

11.*