CVE-2014-3991 - CVE House
Back to Database
Status published Medium CVE-2014-3991

Multiple cross-site scripting (XSS) vulnerabilities in Dolibarr ERP/CRM 3.5.3 allow...

Vulnerability Description

Multiple cross-site scripting (XSS) vulnerabilities in Dolibarr ERP/CRM 3.5.3 allow remote attackers to inject arbitrary web script or HTML via the (1) dol_use_jmobile, (2) dol_optimize_smallscreen, (3) dol_no_mouse_hover, (4) dol_hide_topmenu, (5) dol_hide_leftmenu, (6) mainmenu, or (7) leftmenu parameter to index.php; the (8) dol_use_jmobile, (9) dol_optimize_smallscreen, (10) dol_no_mouse_hover, (11) dol_hide_topmenu, or (12) dol_hide_leftmenu parameter to user/index.php; the (13) dol_use_jmobile, (14) dol_optimize_smallscreen, (15) dol_no_mouse_hover, (16) dol_hide_topmenu, or (17) dol_hide_leftmenu parameter to user/logout.php; the (18) email, (19) firstname, (20) job, (21) lastname, or (22) login parameter in an update action in a "User Card" to user/fiche.php; or the (23) modulepart or (24) file parameter to viewimage.php.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2014-3991

Credits & Attribution

No credits recorded in the NVD database.

References

More from dolibarr

View All →
CVE-2023-5842
Cross-site Scripting (XSS) - Stored in dolibarr/dolibarr
Medium 4.8
CVE-2023-5323
Cross-site Scripting (XSS) - Generic in dolibarr/dolibarr
Medium 5.4
CVE-2022-4093
SQL Injection in dolibarr/dolibarr
High 8.1
CVE-2022-43138
Dolibarr Open Source ERP & CRM for Business before v14.0.1...
Unknown 0
CVE-2022-40871
Dolibarr ERP & CRM <=15.0.3 is vulnerable to Eval injection....
Unknown 0

Affected Vendor

Affected Software

dolibarr erp\/crm
Vulnerable Versions:
3.5.3

Timeline

Official Publish: July 11th, 2014
Last Modified: August 6th, 2024
Added to House: July 19th, 2026

CVSS Vectors

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.