Security readout for executives and security teams
Plain-English summary
Dolibarr ERP/CRM 6.0.0 contains multiple authenticated XSS issues in the company administration page. A logged-in user could submit crafted company profile fields that inject script or HTML. This can put ERP users’ browser sessions and displayed business data at risk, but the source bundle does not provide CVSS, exploit reports, or affected-version breadth.
Executive priority
Treat this as a moderate remediation item for legacy Dolibarr 6.0.0 environments, especially where many internal users have administrative access. Prioritize inventory and vendor-supported upgrade planning over emergency response unless local evidence shows misuse.
Technical view
CVE-2017-14239 covers multiple XSS vectors in htdocs/admin/company.php in Dolibarr ERP/CRM 6.0.0. The listed parameters include company identity, address, contact, director, note, capital, and ProfId fields. The source identifies remote authenticated injection of arbitrary web script or HTML; it does not specify reflected versus stored behavior.
Likely exposure
Exposure is limited by the provided evidence to Dolibarr ERP/CRM 6.0.0 instances where authenticated users can access htdocs/admin/company.php. The bundle does not identify other affected releases, deployment patterns, or unauthenticated exposure.
Exploitation context
There is no KEV listing and no cited source in the bundle claiming active exploitation. The vulnerability requires authentication, lowering broad internet risk, but ERP/CRM systems often contain sensitive customer, financial, and operational data.
Researcher notes
The public bundle is sparse: no CVSS vector, CWE, proof source, or fixed release is provided. The main confirmed technical facts are Dolibarr 6.0.0, authenticated XSS, htdocs/admin/company.php, the affected parameters, and the referenced Dolibarr commit.
Mitigation direction
- Identify any Dolibarr ERP/CRM 6.0.0 deployments.
- Review Dolibarr commit d26b2a694de30f95e46ea54ea72cc54f0d38e548 and vendor guidance.
- Upgrade or patch only according to confirmed Dolibarr release guidance.
- Restrict access to company administration pages to trusted administrative users.
- Monitor company profile fields for unexpected HTML or script-like content.
Validation and detection
- Confirm the deployed Dolibarr version and code provenance.
- Verify whether htdocs/admin/company.php is present and reachable to authenticated users.
- Check access controls for users allowed to edit company settings.
- Review company configuration fields for suspicious markup.
- After patching, confirm output encoding or sanitization covers the listed fields.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2017-14239 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/Dolibarr/dolibarr/commit/d26b2a694de30f95e46ea54ea72cc54f0d38e548CVE reference · x_refsource_CONFIRM
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.