CVE-2024-55228

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-55228
A cross-site scripting (XSS) vulnerability in the Product module of Dolibarr v21.0.0-beta allows attackers to execute arbitrary web scripts or HTMl via a crafted payload injected into the Title parameter.

9.0 /10

CVSS v3 : CRITICAL

V3 Legend

Vector :

Exploitability : 2.3 / Impact : 6.0

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References
Link Resource
https://gist.github.com/Dqtdqt/a942bbce9a5fc851dce366902411c768 Exploit Third Party Advisory
https://github.com/Dolibarr/dolibarr/commit/56710ce9b79a97df093f586c90bdaf6cce6a5808 Patch
https://github.com/Dolibarr/dolibarr/commit/9aa24d9d9aeab36358c725dae3fe20c9631082e7 Patch
https://github.com/Dolibarr/dolibarr/commit/c0250e4c9106b5c889e512a4771f0205d4f99b99 Patch
https://github.com/Dolibarr/dolibarr/security/policy Issue Tracking
Configurations

Configuration 1 (hide)

cpe:2.3:a:dolibarr:dolibarr_erp\/crm:21.0.0:beta:*:*:*:*:*:*
History

06 Feb 2025, 16:06

Type Values Removed Values Added
CVSS v2 : unknown
v3 : 5.4 		v2 : unknown
v3 : 9.0
CPE cpe:2.3:a:dolibarr:dolibarr_erp\/crm:21.0.0:beta:*:*:*:*:*:*
First Time Dolibarr dolibarr Erp\/crm
Dolibarr
References () https://gist.github.com/Dqtdqt/a942bbce9a5fc851dce366902411c768 - () https://gist.github.com/Dqtdqt/a942bbce9a5fc851dce366902411c768 - Exploit, Third Party Advisory
References () https://github.com/Dolibarr/dolibarr/commit/56710ce9b79a97df093f586c90bdaf6cce6a5808 - () https://github.com/Dolibarr/dolibarr/commit/56710ce9b79a97df093f586c90bdaf6cce6a5808 - Patch
References () https://github.com/Dolibarr/dolibarr/commit/9aa24d9d9aeab36358c725dae3fe20c9631082e7 - () https://github.com/Dolibarr/dolibarr/commit/9aa24d9d9aeab36358c725dae3fe20c9631082e7 - Patch
References () https://github.com/Dolibarr/dolibarr/commit/c0250e4c9106b5c889e512a4771f0205d4f99b99 - () https://github.com/Dolibarr/dolibarr/commit/c0250e4c9106b5c889e512a4771f0205d4f99b99 - Patch
References () https://github.com/Dolibarr/dolibarr/security/policy - () https://github.com/Dolibarr/dolibarr/security/policy - Issue Tracking

28 Jan 2025, 20:15

Type Values Removed Values Added
CWE CWE-79
Summary
  • (es) Una vulnerabilidad de cross-site scripting (XSS) en el módulo Producto de Dolibarr v21.0.0-beta permite a los atacantes ejecutar web scripts o HTMl arbitrarios a través de un payload manipulado inyectado en el parámetro Título.
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.4

27 Jan 2025, 17:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-01-27 17:15

Updated : 2025-02-19 20:15

NVD link : CVE-2024-55228

Mitre link : CVE-2024-55228

CVE.ORG link : CVE-2024-55228

JSON object : View

Products Affected

dolibarr

  • dolibarr_erp\/crm
CWE
CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')