CVE-2023-38888

CriticalCVSS 9.6

Published: 20/09/2023(UTC)Updated: 09/07/2026(UTC)Translated: 10/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

1.11%

62th percentile - higher than 62% of all known CVEs

Summary

A Cross Site Scripting (XSS) vulnerability in Dolibarr ERP CRM version 17.0.1 and earlier allows a remote attacker to obtain sensitive information and execute arbitrary code via the REST API module, related to analyseVarsForSqlAndScriptsInjection and testSqlAndScriptInject functions.

Risk Assessment

An attacker can hijack user sessions, steal data, or spread malicious code within the organization, compromising system confidentiality and integrity.

Recommendation

Immediately upgrade Dolibarr ERP CRM to version 17.0.2 or later and restrict REST API module access to trusted IP addresses only.

Original NVD description (English source)

Cross Site Scripting vulnerability in Dolibarr ERP CRM v.17.0.1 and before allows a remote attacker to obtain sensitive information and execute arbitrary code via the REST API module, related to analyseVarsForSqlAndScriptsInjection and testSqlAndScriptInject.