VULNERABILITY INTELLIGENCE

CVE-2020-13240

CVSS score5.4 MEDIUM
EPSS probability0.70%
CISA KEVNot currently listed
Published2020-05-20
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Description

The DMS/ECM module in Dolibarr 11.0.4 allows users with the 'Setup documents directories' permission to rename uploaded files to have insecure file extensions. This bypasses the .noexe protection mechanism against XSS.

Weakness classification

  • nvd@nist.gov: CWE-276

Primary references