Reflected Cross-Site Scripting Vulnerability in Dolibarr Payment Module
CVE-2024-34051

4.6MEDIUM

Key Information:

Vendor

Dolibarr

Vendor
CVE Published:
3 June 2024

What is CVE-2024-34051?

A reflected Cross-Site Scripting (XSS) vulnerability exists in the Dolibarr ERP & CRM application, specifically within the payment module located at htdocs/compta/paiement/card.php. This flaw allows remote attackers to inject arbitrary web scripts or HTML. The vulnerability is exploited by sending a crafted payload through the facid parameter of the application, which can lead to unauthorized actions and exposure of sensitive user data. Organizations using vulnerable versions of Dolibarr should prioritize applying updates to mitigate the risk.

References

https://blog.smarttecs.com/posts/2024-004-cve-2024-34051/

CVSS V3.1

Score:
4.6
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

.