Security readout for executives and security teams
Plain-English summary
Dolibarr ERP-CRM 14.0.2 has a stored cross-site scripting issue in ticket creation. A low-privilege user could place script content in a ticket message that later affects an administrator during ticket handling. The business concern is possible privilege escalation inside an ERP/CRM platform, but public sources do not show confirmed active exploitation.
Executive priority
Treat as a high-priority application risk if Dolibarr 14.0.2 is in use. Focus first on systems with external users, customer portals, or broad internal access. If Dolibarr is not deployed or not version 14.0.2, priority drops substantially.
Technical view
CVE-2021-47779 is CWE-79 stored XSS in Dolibarr ERP-CRM 14.0.2 ticket creation. The source bundle reports CVSS 4.0 score 8.4, network attack vector, low attack complexity, low privileges required, and user interaction by an administrator. ExploitDB and VulnCheck references exist, but KEV is false.
Likely exposure
Organizations running Dolibarr ERP-CRM 14.0.2, especially where low-privilege users can create tickets that administrators later review or manipulate. Exposure is higher for internet-facing or broadly accessible Dolibarr deployments.
Exploitation context
The reported path requires an authenticated low-privilege user and administrator interaction with malicious ticket content. The source bundle includes a public ExploitDB reference, but there is no cited evidence of active exploitation or CISA KEV listing.
Researcher notes
Public details identify the vulnerable module and impact class, but the bundle does not provide an official patch version or vendor advisory. Avoid assuming broader Dolibarr versions are affected without confirmation. ExploitDB presence indicates public exploit information exists, not confirmed real-world exploitation.
Mitigation direction
- Identify and prioritize any Dolibarr ERP-CRM 14.0.2 instances.
- Check Dolibarr vendor channels and GitHub for fixed versions or official guidance.
- Restrict ticket creation to trusted users until remediation is confirmed.
- Reduce administrator interaction with untrusted ticket content during assessment.
- Monitor administrator sessions and privilege changes for suspicious activity.
Validation and detection
- Confirm the deployed Dolibarr version is or is not 14.0.2.
- Review whether the ticket creation module is enabled and user-accessible.
- Validate ticket permissions for low-privilege accounts.
- Use approved non-production testing to confirm whether ticket input is safely handled.
- Review logs for unusual admin actions following ticket review.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-79: User-session and phishing behavior lookup
Client-side and session-facing weaknesses should be reviewed alongside initial-access and user-execution behaviors. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupPrivilege behavior lookup
The CVE wording references privilege impact, so privilege escalation and authorization behavior review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2021-47779 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 8.4 (4.0)
- Known Exploited
- No
- Published
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N——Primary CVE scoreVulnerability scoring details
Base CVSS 4.0 score
8.4HighVector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Source materials
- CVE List V5 sourceCVE List V5
- ExploitDB-50432CVE reference · exploit
- Official Dolibarr Vendor HomepageCVE reference · product
- Dolibarr GitHub RepositoryCVE reference · product
- VulnCheck Advisory: Dolibarr ERP-CRM 14.0.2 - Stored Cross-Site Scripting (XSS) / Privilege EscalationCVE reference · third-party-advisory
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.