CVE-2023-38888

CRITICAL9.6EPSS 5.0%

Cross Site Scripting vulnerability in Dolibarr ERP CRM

Published: 9/20/2023Modified: 4/3/2025

Also known as:GHSA-62wf-h26v-5m57BIT-dolibarr-2023-38888

Description

Cross Site Scripting vulnerability in Dolibarr ERP CRM v.17.0.1 and before allows a remote attacker to obtain sensitive information and execute arbitrary code via the REST API module, related to analyseVarsForSqlAndScriptsInjection and testSqlAndScriptInject.

Affected packages (2)

Bitnami/dolibarrfrom 0, <= 17.0.1
Packagist/dolibarr/dolibarrfrom 0, < 17.0.1

CVSS scores

Source	Version	Severity	Vector
osv	CVSS 3.1	CRITICAL9.6	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

References (4)

ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2023-38888
PATCHhttps://github.com/Dolibarr/dolibarr
WEBhttp://dolibarr.com
WEBhttps://akerva.com/wp-content/uploads/2023/09/AKERVA_Security-Advisory_CVE-2023-38888_Dolibarr_XSS.pdf