Description

Multiple cross-site scripting (XSS) vulnerabilities in Dolibarr ERP/CRM 3.8.3 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) external calendar url or (2) the bank name field in the "import external calendar" page.

Remediation

References

CVE-2015-8685

Related Vulnerabilities

WordPress Plugin File Manager Unspecified Vulnerability (2.2.0)

PHP Out-of-bounds Read Vulnerability (CVE-2017-9118)

WordPress Plugin Divi Builder Cross-Site Scripting (2.17.2)

WordPress Plugin Easy Accept Payments for PayPal Cross-Site Scripting (4.9.9)

Dolibarr Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Vulnerability (CVE-2017-17897)

Severity

Medium

Classification

CVE-2015-8685 CWE-707 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Tags

Missing Update Known Vulnerabilities