Cloudanix VulnDB

CVE-2023-38888

Critical · 9.6

CVSS

9.6

EPSS

1.3%

Published

Sep 20, 2023

CISA due date

—

Cloudanix analysis

Next patch cycle SSVC: Track

Not enough details are available to explain what this issue does or how it affects systems.

Exploit Available
Exploitation
Remote Authenticated
Attacker needs
Low Privilege
Complexity
Low
Impact
Full Compromise
Component
Network Service
Class
Other
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Insufficient information provided; no description or affected products available to determine specific technical effects.

Why it matters to the business

Unknown exposure due to missing details on affected products and fixes; low EPSS suggests limited observed exploitation risk over 1122 days since publication.

How an attack unfolds

Exploit code is publicly available but no description, threat actors, or attack details are provided in the input.

How to fix it

No fixed versions listed; monitor for updates once product details are available.

How to confirm the fix worked

Unable to provide confirmation steps without affected products or versions.

Typical attack path

  1. Insufficient data to outline ordered attack steps

How to detect it

No specific indicators available due to absent vulnerability details.

What your security team should do

  • Obtain full CVE description and affected products to enable accurate assessment
  • Track EPSS trend for any increase in exploitation probability

The record

Cross Site Scripting vulnerability in Dolibarr ERP CRM v.17.0.1 and before allows a remote attacker to obtain sensitive information and execute arbitrary code via the REST API module, related to analyseVarsForSqlAndScriptsInjection and testSqlAndScriptInject.

Affected packages

Ecosystem Package Introduced Fixed
Packagist dolibarr/dolibarr 0 17.0.1
Bitnami dolibarr 0 No fix
Ubuntu:16.04:LTS dolibarr 0 No fix
Ubuntu:Pro:16.04:LTS dolibarr 0 No fix

Related vulnerabilities