CVE-2020-13239
No fix known EPSS <1%
The DMS/ECM module in Dolibarr 11.0.4 renders user-uploaded .html files in the browser when the attachment parameter is removed from the direct download link. This causes XSS.
Products: dolibarr_erp/crm
Affected upstream, no fix yet
| Ecosystem | Package |
|---|---|
| Packagist | dolibarr/dolibarr |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu Pro 16.04 LTS | dolibarr | no fix |