CVE-2023-38888

Fixed upstream EPSS 1%

Cross Site Scripting vulnerability in Dolibarr ERP CRM v.17.0.1 and before allows a remote attacker to obtain sensitive information and execute arbitrary code via the REST API module, related to analyseVarsForSqlAndScriptsInjection and testSqlAndScriptInject.

Published 2023-09-20 · CVE record · OSV

Products: dolibarr_erp/crm

Fixed upstream

Ecosystem	Package	Fixed in
Packagist	dolibarr/dolibarr	17.0.1

Distro releases

Release	Package	Fixed in
Ubuntu Pro 16.04 LTS	dolibarr	no fix