CVE-2018-10095

moderate-risk
Published 2018-05-22

Cross-site scripting (XSS) vulnerability in Dolibarr before 7.0.2 allows remote attackers to inject arbitrary web script or HTML via the foruserlogin parameter to adherents/cartes/carte.php.

Do I need to act?

!
47.5% chance of exploitation in next 30 days
EPSS score — higher than 52% of all CVEs
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
6
CVSS 6.1/10 Medium
NETWORK / LOW complexity

Affected Products (1)

Affected Vendors

Dolibarr

References (8)

Mailing List http://www.openwall.com/lists/oss-security/2018/05/21/3
Issue Tracking https://github.com/Dolibarr/dolibarr/blob/7.0.2/ChangeLog
Issue Tracking https://github.com/Dolibarr/dolibarr/commit/1dc466e1fb687cfe647de4af891720419823...
Third Party Advisory https://sysdream.com/news/lab/2018-05-21-cve-2018-10095-dolibarr-xss-injection-v...
Mailing List http://www.openwall.com/lists/oss-security/2018/05/21/3
Issue Tracking https://github.com/Dolibarr/dolibarr/blob/7.0.2/ChangeLog
Issue Tracking https://github.com/Dolibarr/dolibarr/commit/1dc466e1fb687cfe647de4af891720419823...
Third Party Advisory https://sysdream.com/news/lab/2018-05-21-cve-2018-10095-dolibarr-xss-injection-v...
45
/ 100
moderate-risk
Severity 23/34 · High
Exploitability 17/34 · Moderate
Exposure 5/34 · Minimal