Security readout for executives and security teams
Plain-English summary
Dolibarr ERP CRM could let a low-privileged user save malicious script content in a private note. If an administrator views that note, the script runs in the administrator’s browser and may enable account takeover. Organizations using affected Dolibarr versions should treat this as urgent.
Executive priority
Prioritize remediation immediately if affected Dolibarr is in use, especially where non-admin users can log in. The credible worst case is administrator account takeover. If Dolibarr is not deployed, document non-exposure and close the finding.
Technical view
CVE-2021-25955 is stored XSS in the Dolibarr WYSIWYG Editor module, reported for versions v2.8.1 through v13.0.2. The vulnerable Private Note field at /adherents/note.php can store script content that executes when viewed. The report also cites improper access control over private notes, enabling low-privileged update paths.
Likely exposure
Exposure is likely where Dolibarr ERP CRM runs affected versions and low-privileged users can access or update member private notes. Internet exposure increases business risk, but the source bundle does not prove default exposure or active targeting.
Exploitation context
Exploitation requires an authenticated low-privileged user and a victim who views the affected page. The cited CVSS vector indicates low attack complexity, required user interaction, changed scope, and high confidentiality, integrity, and availability impact. KEV is false, so active exploitation is not established here.
Researcher notes
The public bundle supports stored XSS, privilege escalation risk, CVSS 9.0, and a Dolibarr fixing commit. It does not provide a complete fixed-version statement, exploit-in-the-wild evidence, or a vendor advisory beyond the referenced commit and vulnerability database entry.
Mitigation direction
- Identify all Dolibarr ERP CRM deployments and their versions.
- Upgrade to a Dolibarr release containing the referenced fix.
- Review the linked Dolibarr commit and vendor guidance before remediation.
- Restrict low-privileged access to private note editing where feasible.
- Monitor sessions and administrator activity for suspicious behavior.
Validation and detection
- Confirm whether deployed Dolibarr versions fall between v2.8.1 and v13.0.2.
- Verify whether the WYSIWYG Editor private note path is reachable by low-privileged users.
- Check whether the referenced Dolibarr commit or equivalent fix is present.
- Review application logs for unexpected private note changes.
- Confirm administrative sessions are rotated after remediation.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-79: User-session and phishing behavior lookup
Client-side and session-facing weaknesses should be reviewed alongside initial-access and user-execution behaviors. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupPrivilege behavior lookup
The CVE wording references privilege impact, so privilege escalation and authorization behavior review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2021-25955 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H2.36Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
9CriticalVector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
Source materials
- CVE List V5 sourceCVE List V5
- https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25955CVE reference · x_refsource_MISC
- https://github.com/Dolibarr/dolibarr/commit/796b2d201acb9938b903fb2afa297db289ecc93eCVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.