CVE-2020-13239

The DMS/ECM module in Dolibarr 11.0.4 renders user-uploaded .html files in the browser when the attachment parameter is removed from the direct download link. This causes XSS.

Score

CVSS 3.1 5.4 Medium

Status

Modified - cve@mitre.org

Published

2020-05-20

Last modified

2024-08-04

Weaknesses

CWE-79

Affected products

• Dolibarr Erp/crm (Dolibarr)

References

• https://www.dubget.com/stored-xss-via-file-upload.html