Dolibarr Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2019-17578)

Description

An issue was discovered in Dolibarr 10.0.2. It has XSS via the "outgoing email setup" feature in the admin/mails.php?action=edit URI via the "Sender email for automatic emails (default value in php.ini: Undefined)" field.

Remediation

References

CVE-2019-17578

Related Vulnerabilities

WordPress Plugin WP PHP widget Information Disclosure (1.0.2)

WordPress Plugin W3 Total Cache Multiple Vulnerabilities (0.9.4)

WordPress Plugin MiniCart SQL Injection (1.00.1)

WordPress Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2007-6677)

Joomla! Core 3.6.0 Cross-Site Request Forgery (3.6.0)

Severity

Medium

Classification

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N