Chaindolibarr/dolibarrPackagist:dolibarr/dolibarr
dolibarr/dolibarr: related fixes (2019–2023)
4 CVEs over 3 generations, 16 Sep 2019 to 1 Nov 2023.
Family tree
Left to right by publication date.Oldest first. Select a CVE to open it.- CVE-2019-1619716 Sep 2019 First in the chain
- CVE-2019-1722315 Oct 2019 No direct link to an earlier CVE
- CVE-2022-08192 Mar 2022 related to CVE-2019-16197related to CVE-2019-17223
- CVE-2023-41981 Nov 2023 related to CVE-2022-0819
Exploited in the wild (CISA KEV) Not in KEV Priority score (0 to 100) High confidence Medium Low Link confidenceHow strong the evidence is that two CVEs are related. High: stated in the CVE text or linked in an advisory, or the same code was patched one release apart. Medium: the same code, or a version step plus a similar description. Low: similar description only.
CVEs in this family
Table view of the tree| CVE | Published | Title | Linked from | Priority |
|---|---|---|---|---|
| CVE-2019-16197 | 16 Sep 2019 | In htdocs/societe/card.php in Dolibarr 10.0.1, the value of the User-Agent HTTP header is copied into the HTML… · fixed in 10.0.2 | First in chain | 22.5 |
| CVE-2019-17223 | 15 Oct 2019 | There is HTML Injection in the Note field in Dolibarr ERP/CRM 10.0.2 via user/note.php · fixed in 11.0.1 | First in chain | 13.2 |
| CVE-2022-0819 | 2 Mar 2022 | Code Injection in dolibarr/dolibarr · fixed in 15.0.1 | CVE-2019-16197 · related · Medium | 24.8 |
| CVE-2023-4198 | 1 Nov 2023 | Dolibarr ERP CRM (<= 17.0.3) Improper Access Control · fixed in 18.0.0 | CVE-2022-0819 · related · Medium | 13.8 |