Security readout for executives and security teams
Plain-English summary
Dolibarr ERP CRM 17.0.1 and earlier is reported to have a cross-site scripting issue in its REST API module. The CVE description says this could expose sensitive information and allow arbitrary code execution, but the public metadata does not provide a CVSS score, patch version, or confirmed exploitation.
Executive priority
Prioritize discovery and containment for Dolibarr systems because ERP/CRM platforms can hold sensitive business and customer data. Urgency is moderate unless internet exposure, sensitive data access, or vendor guidance indicates a higher-risk configuration.
Technical view
The issue is tied to REST API module input handling, specifically analyseVarsForSqlAndScriptsInjection and testSqlAndScriptInject. The available description frames it as XSS reachable by a remote attacker. Source data does not clarify authentication requirements, affected configurations, payload conditions, or vendor remediation details.
Likely exposure
Organizations running Dolibarr ERP CRM version 17.0.1 or earlier may be exposed, especially if the REST API module is enabled or reachable by untrusted users. The provided CPE and affected-product fields are incomplete.
Exploitation context
The CVE is not listed as KEV in the provided bundle, and no cited source confirms active exploitation. Treat exploitation status as unconfirmed. The advisory reference indicates public disclosure, but the supplied metadata is not enough to assess exploit maturity.
Researcher notes
The source bundle lacks CVSS, CWE, structured affected products, authentication detail, and patch data. Analysis should stay conservative: confirm affected versions, module exposure, and vendor remediation before assigning severity beyond moderate.
Mitigation direction
- Identify Dolibarr instances running version 17.0.1 or earlier.
- Check official Dolibarr and advisory guidance for fixed versions or configuration mitigations.
- Limit REST API module exposure to trusted networks where operationally possible.
- Disable unused REST API functionality until remediation guidance is confirmed.
- Review access controls for accounts and integrations using the REST API.
Validation and detection
- Inventory Dolibarr versions and confirm whether the REST API module is enabled.
- Review public-facing routes and firewall rules for REST API reachability.
- Check security advisories for the exact fixed release and remediation notes.
- Review application logs for unusual REST API activity around disclosure dates.
- Confirm remediation in a staging environment without using offensive payloads.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
Execution behavior lookup
The CVE wording references code or command execution, so execution technique review may help defensive triage. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2023-38888 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://akerva.com/wp-content/uploads/2023/09/AKERVA_Security-Advisory_CVE-2023-38888_Dolibarr_XSS.pdfCVE reference, mitre
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.