Dolibarr ERP and CRM contain XSS Vulnerability

MEDIUM 6.1CVE-2021-33618 · BIT-dolibarr-2021-33618 · GHSA-fc6h-769x-gff5 · Published 10/11/2021 · updated 17/06/2026

Package	Affected versions	Patched versions
dolibarr/dolibarr Packagist	`≤ 13.0.2`	No fix yet
dolibarr erp/crm dolibarr	`= 13.0.2`	No fix yet

Description

Dolibarr ERP and CRM 13.0.2 allows XSS via object details, as demonstrated by > and < characters in the onpointermove attribute of a BODY element to the user-management feature.

NVD description

Dolibarr ERP and CRM 13.0.2 allows XSS via object details, as demonstrated by > and < characters in the onpointermove attribute of a BODY element to the user-management feature.

References

nvd.nist.gov/vuln/detail/CVE-2021-33618 · ADVISORY
Dolibarr/dolibarr release · WEB
trovent.github.io/security-advisories/TRSA-2105-02/TRSA-2105-02.txt · WEB
trovent.io/security-advisory-2105-02 · WEB
seclists.org/fulldisclosure/2021/Nov/38 · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free