The DMS/ECM module in Dolibarr 11.0.4 allows users with the 'Setup documents directories' permission to rename uploaded files to have insecure file extensions. This bypasses the .noexe protection mechanism against XSS.
References
Link | Resource |
---|---|
https://www.dubget.com/stored-xss-via-file-upload.html | Exploit Third Party Advisory |
Configurations
History
17 Nov 2022, 17:21
Type | Values Removed | Values Added |
---|---|---|
First Time |
Dolibarr dolibarr Erp\/crm
|
|
CWE | CWE-668 | |
CPE | cpe:2.3:a:dolibarr:dolibarr_erp\/crm:11.0.4:*:*:*:*:*:*:* |
Information
Published : 2020-05-20 15:15
Updated : 2023-12-10 13:27
NVD link : CVE-2020-13240
Mitre link : CVE-2020-13240
CVE.ORG link : CVE-2020-13240
JSON object : View
Products Affected
dolibarr
- dolibarr_erp\/crm