CVE-2017-17971 — Cross-site Scripting in Dolibarr

CWE-79 — Cross-site Scripting5 documents4 sources
Severity
6.1MEDIUMNVD
EPSS
0.2%
top 57.91%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
DolibarrDolibarr ERP CRM
Timeline
PublishedDec 29
Latest updateMay 14

Description

The test_sql_and_script_inject function in htdocs/main.inc.php in Dolibarr ERP/CRM 6.0.4 blocks some event attributes but neither onclick nor onscroll, which allows XSS.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NExploitability: 2.8 | Impact: 2.7

Affected Packages2 packages

▶Packagistdolibarr/dolibarr< 6.0.5

🔴Vulnerability Details

4
OSV
Dolibarr ERP and CRM contain XSS Vulnerability↗2022-05-14
▶
GHSA
Dolibarr ERP and CRM contain XSS Vulnerability↗2022-05-14
▶
OSV
CVE-2017-17971: The test_sql_and_script_inject function in htdocs/main↗2017-12-29
▶
CVEList
CVE-2017-17971: The test_sql_and_script_inject function in htdocs/main↗2017-12-29
▶
CVE-2017-17971 — Cross-site Scripting in Dolibarr | cvebase