CVE-2019-16197
Fixed upstream EPSS 3%
In htdocs/societe/card.php in Dolibarr 10.0.1, the value of the User-Agent HTTP header is copied into the HTML document as plain text between tags, leading to XSS.
Products: dolibarr_erp/crm
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Packagist | dolibarr/dolibarr | 10.0.2 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu Pro 16.04 LTS | dolibarr | no fix |