medium4.6
CVE-2024-34051
Reflected Cross-Site Scripting (XSS) in Dolibarr
Impact
A Reflected Cross-site scripting (XSS) vulnerability located in htdocs/compta/paiement/card.php of Dolibarr before 19.0.2 allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into the facid parameter.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| composer | dolibarr/dolibarr | < 19.0.2 | 19.0.2 |
Affected products
| Product | Affected versions |
|---|---|
| Dolibarr | before 19.0.2 |
Versions were read from the advisory text. No structured product data has been published for this record yet.
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://blog.smarttecs.com/posts/2024-004-cve-2024-34051/
- https://github.com/advisories/GHSA-hv2j-6654-x74q
- https://nvd.nist.gov/vuln/detail/CVE-2024-34051
- https://blog.smarttecs.com/posts/2024-004-cve-2024-34051
- https://github.com/Dolibarr/dolibarr/commit/3a3ccc253b8eceddee84f158b2c262a4033b9402