CVE-2019-19210: 
PHP vulnerability analysis and mitigation

Dolibarr ERP/CRM versions 3.0 through 10.0.3 were affected by a stored Cross-Site Scripting (XSS) vulnerability. The vulnerability was discovered on September 6, 2019, and was assigned CVE-2019-19210. The issue was fixed with the release of version 10.0.3 on October 30, 2019 (USD Advisory).

The vulnerability exists because uploaded HTML documents are served with the content-type 'text/html' despite being renamed to .noexe files. This behavior also applies to SVG files. An authenticated user could exploit this by uploading a malicious HTML file as a product document. The CVSS v3.1 base score is 5.4 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N (NVD).

The vulnerability allows attackers to execute arbitrary JavaScript code in the context of other users' browsers who access the malicious document. This could lead to theft of sensitive information, session hijacking, or other client-side attacks (USD Advisory).

The vulnerability was fixed in Dolibarr version 10.0.3. The recommended mitigation is to update to this version or later. The proper fix involves not serving user files with a content-type that allows the interpretation of HTML, instead using 'application/octet-stream' (USD Advisory).