Dolibarr Application Home Page HTML injection vulnerability

CVE-2024-23817

What is CVE-2024-23817?

A vulnerability in Dolibarr ERP/CRM version 18.0.4 allows HTML Injection via the Home page, enabling attackers to inject arbitrary HTML tags. This exploitation could lead to Cross-Site Scripting (XSS) attacks, posing significant security risks. To mitigate this vulnerability, it's critical to validate and sanitize user-generated input, particularly within HTML attributes, and to execute proper output encoding to treat user input as plain text.

References