Dolibarr is an enterprise resource planning (ERP) and customer relationship management (CRM) software package. Version 18.0.4 has a HTML Injection vulnerability in the Home page of the Dolibarr Application. This vulnerability allows an attacker to inject arbitrary HTML tags and manipulate the rendered content in the application's response. Specifically, I was able to successfully inject a new HTML tag into the returned document and, as a result, was able to comment out some part of the Dolibarr App Home page HTML code. This behavior can be exploited to perform various attacks like Cross-Site Scripting (XSS). To remediate the issue, validate and sanitize all user-supplied input, especially within HTML attributes, to prevent HTML injection attacks; and implement proper output encoding when rendering user-provided data to ensure it is treated as plain text rather than executable HTML.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Dolibarr is an enterprise resource planning (ERP) and customer relationship management (CRM) software
    package. Version 18.0.4 has a HTML Injection vulnerability in the Home page of the Dolibarr Application.
    This vulnerability allows an attacker to inject arbitrary HTML tags and manipulate the rendered content in
    the application's response. Specifically, I was able to successfully inject a new HTML tag into the
    returned document and, as a result, was able to comment out some part of the Dolibarr App Home page HTML
    code. This behavior can be exploited to perform various attacks like Cross-Site Scripting (XSS). To
    remediate the issue, validate and sanitize all user-supplied input, especially within HTML attributes, to
    prevent HTML injection attacks; and implement proper output encoding when rendering user-provided data to
    ensure it is treated as plain text rather than executable HTML. (CVE-2024-23817)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Dolibarr is an enterprise resource planning (ERP) and customer relationship management (CRM) software     package. Version 18.0.4 has a HTML Injection vulnerability in the Home page of the Dolibarr Application.
    This vulnerability allows an attacker to inject arbitrary HTML tags and manipulate the rendered content in     the application's response. Specifically, I was able to successfully inject a new HTML tag into the     returned document and, as a result, was able to comment out some part of the Dolibarr App Home page HTML     code. This behavior can be exploited to perform various attacks like Cross-Site Scripting (XSS). To     remediate the issue, validate and sanitize all user-supplied input, especially within HTML attributes, to     prevent HTML injection attacks; and implement proper output encoding when rendering user-provided data to     ensure it is treated as plain text rather than executable HTML. (CVE-2024-23817)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
436429	SCA: security update for dolibarr/dolibarr (GHSA-7947-48q7-cp5m)	Tenable Cloud Security	SCA Checks	medium
436429	SCA: security update for dolibarr/dolibarr (GHSA-7947-48q7-cp5m)	Tenable Self-Hosted Container Security	SCA Checks	medium
262058	Linux Distros Unpatched Vulnerability : CVE-2024-23817	Nessus	Misc.	medium

Detections

Analytics

CVE-2024-23817

medium

Tenable Plugins

medium

medium

medium