CVE-2019-19206:
Dolibarr ERP and CRM contain XSS Vulnerability
5.4
CVSS ScoreBasic Information
CVE ID
GHSA ID
EPSS Score
-
CWE
Published
5/24/2022
Updated
9/26/2023
KEV Status
No
Technology
PHP
PHPTechnical Details
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| dolibarr/dolibarr | composer | <= 10.0.3 |
Vulnerability Intelligence
Miggo AI
Miggo AIRoot Cause Analysis
The vulnerability manifests in the image viewing endpoint (viewimage.php) when handling SVG files. Key indicators:
- The attack vector uses 'viewimage.php?file=' parameter to access uploaded SVGs
- Dolibarr fails to either:
- Validate MIME types during upload (allowing SVG with JS)
- Sanitize SVG content during rendering
- SVG files with embedded <script> tags execute when rendered by browsers
- The vulnerability pattern matches common XSS in direct file serving scenarios where:
- User-controlled filenames are used to fetch content
- File content is served with original markup
- No output encoding is applied for embedded scripts