medium5.4
CVE-2020-13239
Dolibarr Stored Cross-site Scripting via file upload
Impact
The DMS/ECM module in Dolibarr 11.0.4 renders user-uploaded .html files in the browser when the attachment parameter is removed from the direct download link. This causes XSS.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| composer | dolibarr/dolibarr | = 11.0.4 | none recorded |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Dolibarr | Dolibarr Erp\/Crm | Version 11.0.4 |