UBUNTU-CVE-2019-11199

See a problem?
Please try reporting it to the source first.
Source
https://ubuntu.com/security/CVE-2019-11199
Import Source
https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2019/UBUNTU-CVE-2019-11199.json
JSON Data
https://api.osv.dev/v1/vulns/UBUNTU-CVE-2019-11199
Upstream
Published
2019-07-29T16:15:00Z
Modified
2026-06-17T20:15:13Z
Severity
  • 5.4 (Medium) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N CVSS Calculator
  • Ubuntu - medium
Summary
[none]
Details

Dolibarr ERP/CRM 9.0.1 was affected by stored XSS within uploaded files. These vulnerabilities allowed the execution of a JavaScript payload each time any regular user or administrative user clicked on the malicious link hosted on the same domain. The vulnerabilities could be exploited by low privileged users to target administrators. The viewimage.php page did not perform any contextual output encoding and would display the content within the uploaded file with a user-requested MIME type.

References

Affected packages

Ubuntu:Pro:16.04:LTS / dolibarr

Package

Name
dolibarr
Purl
pkg:deb/ubuntu/dolibarr?arch=source&distro=esm-apps-legacy%2Fxenial

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

3.*
3.5.5+dfsg1-2
3.5.7+dfsg1-1
3.5.8+dfsg1-1
3.5.8+dfsg1-1ubuntu1
3.5.8+dfsg1-1ubuntu1+esm1

Ecosystem specific 

{
    "binaries": [
        {
            "binary_name": "dolibarr",
            "binary_version": "3.5.8+dfsg1-1ubuntu1+esm1"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2019/UBUNTU-CVE-2019-11199.json"