Medium severity · published Jan 15, 2016
CVE-2015-8685
Multiple cross-site scripting (XSS) vulnerabilities in Dolibarr ERP/CRM 3.8.3 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) external…
6.1
CVSS
1.7%
EPSS
No
On KEV
Description
Multiple cross-site scripting (XSS) vulnerabilities in Dolibarr ERP/CRM 3.8.3 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) external calendar url or (2) the bank name field in the "import external calendar" page.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)1.7% · higher than 77% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DO
Dolibarr · Dolibarr
through 3.8.2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2015-8685
CVE.org
https://www.cve.org/CVERecord?id=CVE-2015-8685
packetstormsecurity.com
http://packetstormsecurity.com/files/135256/dolibarr-HTML-Injection.html
Exploit
http://seclists.org/fulldisclosure/2016/Jan/40
Exploit
https://github.com/Dolibarr/dolibarr/issues/4291
github.com
https://github.com/GPCsolutions/dolibarr/commit/0d3181324c816bdf664ca5e1548dfe8eb05c54f8
More from Dolibarr
9.8
CVE-2019-19212
Dolibarr ERP/CRM 3.0 through 10.0.3 allows XSS via the qty parameter to product/fournisseurs.php (product price screen)
9.8
CVE-2018-16809
An issue was discovered in Dolibarr through 7.0.0
9.8
CVE-2018-9019
SQL Injection vulnerability in Dolibarr before version 7.0.2 allows remote attackers to execute arbitrary SQL commands via the sortfield parameter to…
9.8
CVE-2018-10094
SQL injection vulnerability in Dolibarr before 7.0.2 allows remote attackers to execute arbitrary SQL commands via vectors involving integer parameters without quotes
9.8
CVE-2017-14242
SQL injection vulnerability in don/list.php in Dolibarr version 6.0.0 allows remote attackers to execute arbitrary SQL commands via the statut parameter