VDB
CVE-2015-8685
CVE-2015-8685
REJECTED
Multiple cross-site scripting (XSS) vulnerabilities in Dolibarr ERP/CRM 3.8.3 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) external calendar url or (2) the bank name field in the "import external calendar" page.
EPSS 0.21% · 43.7th percentile
Risk Scores
EPSS Score
0.21%
43.7th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Ubuntu:16.04:LTS | dolibarr | 3.5.5+dfsg1-2, 3.5.7+dfsg1-1, 0 |
Exploit Intelligence
- http://packetstormsecurity.com/files/135256/dolibarr-HTML-Injection.html (circl)
- https://github.com/GPCsolutions/dolibarr/commit/0d3181324c816bdf664ca5e1548dfe8eb05c54f8 (circl)
- http://seclists.org/fulldisclosure/2016/Jan/40 (vulncheck-nvd)
- https://github.com/Dolibarr/dolibarr/issues/4291 (vulncheck-nvd)
Timeline
- Jan 15, 2016 CVE Published
- Feb 4, 2022 EPSS Score
- Mar 29, 2022 EPSS Score
- May 20, 2022 EPSS Score
- Jul 12, 2022 EPSS Score
- Sep 3, 2022 EPSS Score
- Oct 26, 2022 EPSS Score
- Dec 18, 2022 EPSS Score
- Feb 8, 2023 EPSS Score
- Mar 7, 2023 EPSS Score
- Apr 2, 2023 EPSS Score
- May 25, 2023 EPSS Score
References
- https://ubuntu.com/security/CVE-2015-8685 third-party-advisory
- https://github.com/Dolibarr/dolibarr/issues/4291 third-party-advisory
- https://github.com/GPCsolutions/dolibarr/commit/0d3181324c816bdf664ca5e1548dfe8eb05c54f8 third-party-advisory
- https://www.cve.org/CVERecord?id=CVE-2015-8685 third-party-advisory