CVE-2020-14475

Vulnerability

Overview

CVE-2020-14475 describes a reflected cross-site scripting (XSS) vulnerability in Dolibarr ERP/CRM version 11.0.3. The flaw resides in the public/notice.php script, where user-supplied input passed via the transphrase and transkey parameters is insufficiently sanitized before being output to the browser [1][2]. The official description confirms that remote attackers can inject arbitrary web script or HTML through these parameters.

Exploitation

Details

An attacker can exploit this vulnerability by crafting a malicious URL that includes a transphrase or transkey parameter containing JavaScript or HTML. The script is then reflected back to the victim's browser in the response from public/notice.php. No authentication is required for this endpoint, making it accessible to unauthenticated remote attackers. The attack surface is the publicly accessible notice.php page, which may be reachable without any login [2][3].

Impact

Successful exploitation allows an attacker to execute arbitrary client-side scripts in the context of the victim's session. This can lead to session hijacking, defacement of the application interface, or redirection to malicious sites. The impact is limited to the browser session but can be leveraged for further attacks against authenticated users.

Mitigation

Status

The Dolibarr project addressed this vulnerability in commit 22ca5e067189bffe8066df26df923a386f044c08, which introduces dol_escape_htmltag() to properly escape output [3]. Users should upgrade to a version that includes this patch. No official workarounds have been published, but applying the commit or updating to a newer release (e.g., 11.0.4 or later) mitigates the issue. This CVE is not currently listed in the Known Exploited Vulnerabilities (KEV) catalog.