CVE-2011-4329

Dolibarr 3.1.0 - XSS

Title source: llm

Description

Multiple cross-site scripting (XSS) vulnerabilities in Dolibarr 3.1.0 allow remote attackers to inject arbitrary web script or HTML via (1) the username parameter in a setup action to admin/company.php, or the PATH_INFO to (2) admin/security_other.php, (3) admin/events.php, or (4) admin/user.php.

References (5)

[Third Party Advisory] http://archives.neohapsis.com/archives/bugtraq/2011-11/0052.html

[Third Party Advisory] http://archives.neohapsis.com/archives/bugtraq/2011-11/0138.html

[Broken Link, Third Party Advisory, VDB Entry] http://www.securityfocus.com/bid/50617

[Permissions Required] https://doliforge.org/tracker/?func=detail&aid=232&group_id=144

[Patch, Third Party Advisory] https://github.com/Dolibarr/dolibarr/commit/762f98ab4137749d0993612b4e3544a4207e78a1

Scores

EPSS 0.0047

EPSS Percentile 64.1%

Classification

CWE

CWE-79

Status published

Affected Products (2)

dolibarr/dolibarr_erp\/crm

n/a/n/a

Timeline

Published Nov 28, 2011

Tracked Since Feb 18, 2026