CVE-2015-8685

Published: Jan 15, 2016Modified: May 6, 2026

6.1

Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Exploitability: 2.8 / Impact: 2.7

Source: NVD

Description

Multiple cross-site scripting (XSS) vulnerabilities in Dolibarr ERP/CRM 3.8.3 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) external calendar url or (2) the bank name field in the "import external calendar" page.

Affected (1)

Products: Dolibarr: Dolibarr

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Dolibarr Dolibarr	Up to 3.8.2

Related CWEs

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References (8)

http://packetstormsecurity.com/files/135256/dolibarr-HTML-Injection.html

Source: cve@mitre.org

http://seclists.org/fulldisclosure/2016/Jan/40

Source: cve@mitre.org

Exploit

https://github.com/Dolibarr/dolibarr/issues/4291

Source: cve@mitre.org

Exploit

https://github.com/GPCsolutions/dolibarr/commit/0d3181324c816bdf664ca5e1548dfe8eb05c54f8

Source: cve@mitre.org

http://packetstormsecurity.com/files/135256/dolibarr-HTML-Injection.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://seclists.org/fulldisclosure/2016/Jan/40

Source: af854a3a-2127-422b-91ae-364da2661108

Exploit

https://github.com/Dolibarr/dolibarr/issues/4291

Source: af854a3a-2127-422b-91ae-364da2661108

Exploit

https://github.com/GPCsolutions/dolibarr/commit/0d3181324c816bdf664ca5e1548dfe8eb05c54f8

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.