In short
- CVE-2017-17971 is a MEDIUM (CVSS 6.1) vulnerability affecting dolibarr/dolibarr, dolibarr erp/crm (dolibarr).
- Chance of exploitation in the next 30 days (EPSS): 1.0%, higher than 63.2% of all vulnerabilities.
- Fix: update to 6.0.5 or later.
Description
The test_sql_and_script_inject function in htdocs/main.inc.php in Dolibarr ERP/CRM 6.0.4 blocks some event attributes but neither onclick nor onscroll, which allows XSS.
NVD description
The test_sql_and_script_inject function in htdocs/main.inc.php in Dolibarr ERP/CRM 6.0.4 blocks some event attributes but neither onclick nor onscroll, which allows XSS.
More vulnerabilities in dolibarr/dolibarr
See all →Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free