CVE-2019-11199 Cross-site scripting in n/a

What is CVE-2019-11199?

CVE-2019-11199 is a medium-severity cross-site scripting vulnerability in Dolibarr Dolibarr Erp\/Crm, published on 29 Jul 2019. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.

Official description

Dolibarr ERP/CRM 9.0.1 was affected by stored XSS within uploaded files. These vulnerabilities allowed the execution of a JavaScript payload each time any regular user or administrative user clicked on the malicious link hosted on the same domain. The vulnerabilities could be exploited by low privileged users to target administrators. The viewimage.php page did not perform any contextual output encoding and would display the content within the uploaded file with a user-requested MIME type.

Weakness: CWE-79

Which versions are affected by CVE-2019-11199?

It affects 1 product.

Products include Dolibarr Dolibarr Erp\/Crm.

How do I fix CVE-2019-11199?

No fix has been published for CVE-2019-11199 yet. Limit exposure of the affected software until one is available.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2019-11199 being exploited?

There is no known exploitation of CVE-2019-11199 in the wild and no public exploit code.

Other vulnerabilities in Dolibarr Dolibarr Erp\/Crm

• CVE-2022-43138 Dolibarr vulnerable to privilege escalation Critical 9.8
• CVE-2022-40871 Dolibarr vulnerable to Eval Injection Critical 9.8
• CVE-2021-33816 Dolibarr remote PHP code execution Critical 9.8
• CVE-2020-7995 Dolibarr Improper Restriction of Excessive Authentication Attempts Critical 9.8
• CVE-2013-2091 SQL injection in dolibarr Critical 9.8

All Dolibarr Dolibarr Erp\/Crm vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-37x9-fxq8-3m6j, UBUNTU-CVE-2019-11199.