CVE-2017-9838

Severity: medium (CVSS 5.4 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2018-04-11 · updated 2026-06-17
Weakness: CWE-79

Description

Dolibarr ERP/CRM is affected by multiple reflected Cross-Site Scripting (XSS) vulnerabilities in versions before 5.0.4: index.php (leftmenu parameter), core/ajax/box.php (PATH_INFO), product/stats/card.php (type parameter), holiday/list.php (month_create, month_start, and month_end parameters), and don/card.php (societe, lastname, firstname, address, zipcode, town, and email parameters).

Affected products

dolibarr: before 5.0.4 — fixed in 5.0.4

How to fix

Upgrade to a fixed version: dolibarr 5.0.4. Check the vendor advisory for mitigations.

References

https://www.wizlynxgroup.com/security-research-advisories/vuln/WLX-2017-008
https://www.wizlynxgroup.com/security-research-advisories/vuln/WLX-2017-008

Get alerted when CVE-2017-9838 or the next vulnerability affects your stack