Vulnerability-Lookup

CNVD-2017-32849

Vulnerability from cnvd - Published: 2017-11-06

Title

Dolibarr ERP/CRM存在多个跨站脚本漏洞（CNVD-2017-32849）

Description

Dolibarr ERP/CRM是一个针对中小型企业、组织或自由职业者的开源软件/自由软件。它包括不同的功能，例如企业资源计划 (ERP) 和客户关系管理 (CRM)，以及应用于其它不同活动的功能。 Dolibarr ERP/CRM存在多个跨站脚本漏洞，使远程认证用户可通过htdocs/admin/company.php的(1) CompanyName、(2) CompanyAddress、(3) CompanyZip、(4) CompanyTown、(5) Fax、(6) EMail、(7) Web、(8) ManagingDirectors、(9) Note、(10) Capital、(11) ProfId1、(12) ProfId2、(13) ProfId3、(14) ProfId4、(15) ProfId5、(16) ProfId6参数注入任意web脚本或HTML。

Severity

低

Patch Name

Dolibarr ERP/CRM存在多个跨站脚本漏洞（CNVD-2017-32849）的补丁

Patch Description

Formal description

厂商已发布漏洞修复程序，请及时关注更新： https://github.com/Dolibarr/dolibarr/commit/d26b2a694de30f95e46ea54ea72cc54f0d38e548

Reference

https://nvd.nist.gov/vuln/detail/CVE-2017-14239

Impacted products

Name
Dolibarr ERP/CRM 6.0.0

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2017-14239"
    }
  },
  "description": "Dolibarr ERP/CRM\u662f\u4e00\u4e2a\u9488\u5bf9\u4e2d\u5c0f\u578b\u4f01\u4e1a\u3001\u7ec4\u7ec7\u6216\u81ea\u7531\u804c\u4e1a\u8005\u7684\u5f00\u6e90\u8f6f\u4ef6/\u81ea\u7531\u8f6f\u4ef6\u3002\u5b83\u5305\u62ec\u4e0d\u540c\u7684\u529f\u80fd\uff0c\u4f8b\u5982\u4f01\u4e1a\u8d44\u6e90\u8ba1\u5212 (ERP) \u548c\u5ba2\u6237\u5173\u7cfb\u7ba1\u7406 (CRM)\uff0c\u4ee5\u53ca\u5e94\u7528\u4e8e\u5176\u5b83\u4e0d\u540c\u6d3b\u52a8\u7684\u529f\u80fd\u3002\r\n\r\nDolibarr ERP/CRM\u5b58\u5728\u591a\u4e2a\u8de8\u7ad9\u811a\u672c\u6f0f\u6d1e\uff0c\u4f7f\u8fdc\u7a0b\u8ba4\u8bc1\u7528\u6237\u53ef\u901a\u8fc7htdocs/admin/company.php\u7684(1) CompanyName\u3001(2) CompanyAddress\u3001(3) CompanyZip\u3001(4) CompanyTown\u3001(5) Fax\u3001(6) EMail\u3001(7) Web\u3001(8) ManagingDirectors\u3001(9) Note\u3001(10) Capital\u3001(11) ProfId1\u3001(12) ProfId2\u3001(13) ProfId3\u3001(14) ProfId4\u3001(15) ProfId5\u3001(16) ProfId6\u53c2\u6570\u6ce8\u5165\u4efb\u610fweb\u811a\u672c\u6216HTML\u3002",
  "discovererName": "eldy",
  "formalWay": "\u5382\u5546\u5df2\u53d1\u5e03\u6f0f\u6d1e\u4fee\u590d\u7a0b\u5e8f\uff0c\u8bf7\u53ca\u65f6\u5173\u6ce8\u66f4\u65b0\uff1a\r\nhttps://github.com/Dolibarr/dolibarr/commit/d26b2a694de30f95e46ea54ea72cc54f0d38e548",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2017-32849",
  "openTime": "2017-11-06",
  "patchDescription": "Dolibarr ERP/CRM\u662f\u4e00\u4e2a\u9488\u5bf9\u4e2d\u5c0f\u578b\u4f01\u4e1a\u3001\u7ec4\u7ec7\u6216\u81ea\u7531\u804c\u4e1a\u8005\u7684\u5f00\u6e90\u8f6f\u4ef6/\u81ea\u7531\u8f6f\u4ef6\u3002\u5b83\u5305\u62ec\u4e0d\u540c\u7684\u529f\u80fd\uff0c\u4f8b\u5982\u4f01\u4e1a\u8d44\u6e90\u8ba1\u5212 (ERP) \u548c\u5ba2\u6237\u5173\u7cfb\u7ba1\u7406 (CRM)\uff0c\u4ee5\u53ca\u5e94\u7528\u4e8e\u5176\u5b83\u4e0d\u540c\u6d3b\u52a8\u7684\u529f\u80fd\u3002\r\n\r\nDolibarr ERP/CRM\u5b58\u5728\u591a\u4e2a\u8de8\u7ad9\u811a\u672c\u6f0f\u6d1e\uff0c\u4f7f\u8fdc\u7a0b\u8ba4\u8bc1\u7528\u6237\u53ef\u901a\u8fc7htdocs/admin/company.php\u7684(1) CompanyName\u3001(2) CompanyAddress\u3001(3) CompanyZip\u3001(4) CompanyTown\u3001(5) Fax\u3001(6) EMail\u3001(7) Web\u3001(8) ManagingDirectors\u3001(9) Note\u3001(10) Capital\u3001(11) ProfId1\u3001(12) ProfId2\u3001(13) ProfId3\u3001(14) ProfId4\u3001(15) ProfId5\u3001(16) ProfId6\u53c2\u6570\u6ce8\u5165\u4efb\u610fweb\u811a\u672c\u6216HTML\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "Dolibarr ERP/CRM\u5b58\u5728\u591a\u4e2a\u8de8\u7ad9\u811a\u672c\u6f0f\u6d1e\uff08CNVD-2017-32849\uff09\u7684\u8865\u4e01",
  "products": {
    "product": "Dolibarr ERP/CRM 6.0.0"
  },
  "referenceLink": "https://nvd.nist.gov/vuln/detail/CVE-2017-14239",
  "serverity": "\u4f4e",
  "submitTime": "2017-09-12",
  "title": "Dolibarr ERP/CRM\u5b58\u5728\u591a\u4e2a\u8de8\u7ad9\u811a\u672c\u6f0f\u6d1e\uff08CNVD-2017-32849\uff09"
}

CVE-2017-14239 (GCVE-0-2017-14239)

Vulnerability from cvelistv5 – Published: 2017-09-11 09:00 – Updated: 2024-08-05 19:20

Summary

Multiple cross-site scripting (XSS) vulnerabilities in Dolibarr ERP/CRM 6.0.0 allow remote authenticated users to inject arbitrary web script or HTML via the (1) CompanyName, (2) CompanyAddress, (3) CompanyZip, (4) CompanyTown, (5) Fax, (6) EMail, (7) Web, (8) ManagingDirectors, (9) Note, (10) Capital, (11) ProfId1, (12) ProfId2, (13) ProfId3, (14) ProfId4, (15) ProfId5, or (16) ProfId6 parameter to htdocs/admin/company.php.

Severity

No CVSS data available.

CWE

Assigner

mitre

References

1 reference

URL	Tags
https://github.com/Dolibarr/dolibarr/commit/d26b2…	x_refsource_CONFIRM

Date Public

2017-09-10 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T19:20:41.281Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/Dolibarr/dolibarr/commit/d26b2a694de30f95e46ea54ea72cc54f0d38e548"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2017-09-10T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Multiple cross-site scripting (XSS) vulnerabilities in Dolibarr ERP/CRM 6.0.0 allow remote authenticated users to inject arbitrary web script or HTML via the (1) CompanyName, (2) CompanyAddress, (3) CompanyZip, (4) CompanyTown, (5) Fax, (6) EMail, (7) Web, (8) ManagingDirectors, (9) Note, (10) Capital, (11) ProfId1, (12) ProfId2, (13) ProfId3, (14) ProfId4, (15) ProfId5, or (16) ProfId6 parameter to htdocs/admin/company.php."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-09-11T08:57:01.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/Dolibarr/dolibarr/commit/d26b2a694de30f95e46ea54ea72cc54f0d38e548"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2017-14239",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Multiple cross-site scripting (XSS) vulnerabilities in Dolibarr ERP/CRM 6.0.0 allow remote authenticated users to inject arbitrary web script or HTML via the (1) CompanyName, (2) CompanyAddress, (3) CompanyZip, (4) CompanyTown, (5) Fax, (6) EMail, (7) Web, (8) ManagingDirectors, (9) Note, (10) Capital, (11) ProfId1, (12) ProfId2, (13) ProfId3, (14) ProfId4, (15) ProfId5, or (16) ProfId6 parameter to htdocs/admin/company.php."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://github.com/Dolibarr/dolibarr/commit/d26b2a694de30f95e46ea54ea72cc54f0d38e548",
              "refsource": "CONFIRM",
              "url": "https://github.com/Dolibarr/dolibarr/commit/d26b2a694de30f95e46ea54ea72cc54f0d38e548"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2017-14239",
    "datePublished": "2017-09-11T09:00:00.000Z",
    "dateReserved": "2017-09-10T00:00:00.000Z",
    "dateUpdated": "2024-08-05T19:20:41.281Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CNVD-2017-32849

CVE-2017-14239 (GCVE-0-2017-14239)

Tags

Sightings

Nomenclature