CVE-2022-22293

Description

admin/limits.php in Dolibarr 7.0.2 allows HTML injection, as demonstrated by the MAIN_MAX_DECIMALS_TOT parameter.

How to fix CVE-2022-22293

To remediate CVE-2022-22293, upgrade the affected package to a fixed version below.

• Bitnami/dolibarr—no fix listed
• Packagist/dolibarr/dolibarr—upgrade to 13.0.0 or later

Is CVE-2022-22293 being exploited?

Low — EPSS is 0.3%, meaning exploitation activity has not been observed at scale.

Affected packages (2)

• >= 7.0.2, <= 7.0.2
• from 0, < 13.0.0

CVSS scores

References (4)

• ADVISORYnvd.nist.gov/vuln/detail/CVE-2022-22293
• PATCHgithub.com/Dolibarr/dolibarr
• WEBgithub.com/Dolibarr/dolibarr/issues/20237
• WEBgithub.com/mustgundogdu/Research/blob/main/Dolibar_7.0.2-StoredXSS/README.md