CVE-2020-14475

MEDIUM6.1EPSS 0.26%

Dolibarr reflected cross-site scripting (XSS) vulnerability

Published: 5/24/2022Modified: 4/3/2025

Also known as:GHSA-m396-2x3h-v3v4BIT-dolibarr-2020-14475

Description

A reflected cross-site scripting (XSS) vulnerability in Dolibarr 11.0.3 allows remote attackers to inject arbitrary web script or HTML into public/notice.php (related to transphrase and transkey).

Affected packages (2)

Bitnami/dolibarr>= 11.0.3, <= 11.0.3
Packagist/dolibarr/dolibarrfrom 0, < 11.0.5

CVSS scores

Source	Version	Severity	Vector
osv	CVSS 3.1	MEDIUM6.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

References (3)

ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2020-14475
PATCHhttps://github.com/Dolibarr/dolibarr
WEBhttps://github.com/Dolibarr/dolibarr/commit/22ca5e067189bffe8066df26df923a386f044c08