Read the docs
TI-2011-02380 Aliases CVE-2011-2720GHSA-v8g3-5fhj-q8xr

The autocompletion functionality in GLPI before 0.80.2 does not blacklist certain…

Priority LOW 28CWE-200Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
Partial · None · None
Fix status
No fix listed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA. Impact type from CWE-200.

Summary

The autocompletion functionality in GLPI before 0.80.2 does not blacklist certain username and password fields, which allows remote attackers to obtain sensitive information via a crafted POST request.

Why it matters now

EPSS 0.0285 86th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 52

CPEVersionsRoleVendor
cpe:2.3:a:glpi-project:glpi:*:*:*:*:*:*:*:*up to 0.80.1Vulnerableglpi-project
cpe:2.3:a:glpi-project:glpi:0.5:*:*:*:*:*:*:*0.5Vulnerableglpi-project
cpe:2.3:a:glpi-project:glpi:0.5:rc1:*:*:*:*:*:*0.5 rc1Vulnerableglpi-project
cpe:2.3:a:glpi-project:glpi:0.5:rc2:*:*:*:*:*:*0.5 rc2Vulnerableglpi-project
cpe:2.3:a:glpi-project:glpi:0.6:*:*:*:*:*:*:*0.6Vulnerableglpi-project
cpe:2.3:a:glpi-project:glpi:0.6:rc1:*:*:*:*:*:*0.6 rc1Vulnerableglpi-project
cpe:2.3:a:glpi-project:glpi:0.6:rc2:*:*:*:*:*:*0.6 rc2Vulnerableglpi-project
cpe:2.3:a:glpi-project:glpi:0.6:rc3:*:*:*:*:*:*0.6 rc3Vulnerableglpi-project
cpe:2.3:a:glpi-project:glpi:0.42:*:*:*:*:*:*:*0.42Vulnerableglpi-project
cpe:2.3:a:glpi-project:glpi:0.51:*:*:*:*:*:*:*0.51Vulnerableglpi-project
  • cpe:2.3:a:glpi-project:glpi:*:*:*:*:*:*:*:* Versions up to 0.80.1 Vulnerable ·glpi-project
  • cpe:2.3:a:glpi-project:glpi:0.5:*:*:*:*:*:*:* Versions 0.5 Vulnerable ·glpi-project
  • cpe:2.3:a:glpi-project:glpi:0.5:rc1:*:*:*:*:*:* Versions 0.5 rc1 Vulnerable ·glpi-project
  • cpe:2.3:a:glpi-project:glpi:0.5:rc2:*:*:*:*:*:* Versions 0.5 rc2 Vulnerable ·glpi-project
  • cpe:2.3:a:glpi-project:glpi:0.6:*:*:*:*:*:*:* Versions 0.6 Vulnerable ·glpi-project
  • cpe:2.3:a:glpi-project:glpi:0.6:rc1:*:*:*:*:*:* Versions 0.6 rc1 Vulnerable ·glpi-project
  • cpe:2.3:a:glpi-project:glpi:0.6:rc2:*:*:*:*:*:* Versions 0.6 rc2 Vulnerable ·glpi-project
  • cpe:2.3:a:glpi-project:glpi:0.6:rc3:*:*:*:*:*:* Versions 0.6 rc3 Vulnerable ·glpi-project
  • cpe:2.3:a:glpi-project:glpi:0.42:*:*:*:*:*:*:* Versions 0.42 Vulnerable ·glpi-project
  • cpe:2.3:a:glpi-project:glpi:0.51:*:*:*:*:*:*:* Versions 0.51 Vulnerable ·glpi-project
Show 42 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:glpi-project:glpi:0.51a:*:*:*:*:*:*:*0.51aVulnerableglpi-project
cpe:2.3:a:glpi-project:glpi:0.65:*:*:*:*:*:*:*0.65Vulnerableglpi-project
cpe:2.3:a:glpi-project:glpi:0.65:rc1:*:*:*:*:*:*0.65 rc1Vulnerableglpi-project
cpe:2.3:a:glpi-project:glpi:0.65:rc2:*:*:*:*:*:*0.65 rc2Vulnerableglpi-project
cpe:2.3:a:glpi-project:glpi:0.68:*:*:*:*:*:*:*0.68Vulnerableglpi-project
cpe:2.3:a:glpi-project:glpi:0.68:rc1:*:*:*:*:*:*0.68 rc1Vulnerableglpi-project
cpe:2.3:a:glpi-project:glpi:0.68:rc2:*:*:*:*:*:*0.68 rc2Vulnerableglpi-project
cpe:2.3:a:glpi-project:glpi:0.68:rc3:*:*:*:*:*:*0.68 rc3Vulnerableglpi-project
cpe:2.3:a:glpi-project:glpi:0.68.1:*:*:*:*:*:*:*0.68.1Vulnerableglpi-project
cpe:2.3:a:glpi-project:glpi:0.68.2:*:*:*:*:*:*:*0.68.2Vulnerableglpi-project
cpe:2.3:a:glpi-project:glpi:0.68.3:*:*:*:*:*:*:*0.68.3Vulnerableglpi-project
cpe:2.3:a:glpi-project:glpi:0.70:*:*:*:*:*:*:*0.70Vulnerableglpi-project
cpe:2.3:a:glpi-project:glpi:0.70:rc1:*:*:*:*:*:*0.70 rc1Vulnerableglpi-project
cpe:2.3:a:glpi-project:glpi:0.70:rc2:*:*:*:*:*:*0.70 rc2Vulnerableglpi-project
cpe:2.3:a:glpi-project:glpi:0.70:rc3:*:*:*:*:*:*0.70 rc3Vulnerableglpi-project
cpe:2.3:a:glpi-project:glpi:0.70.1:*:*:*:*:*:*:*0.70.1Vulnerableglpi-project
cpe:2.3:a:glpi-project:glpi:0.70.2:*:*:*:*:*:*:*0.70.2Vulnerableglpi-project
cpe:2.3:a:glpi-project:glpi:0.71:*:*:*:*:*:*:*0.71Vulnerableglpi-project
cpe:2.3:a:glpi-project:glpi:0.71.1:*:*:*:*:*:*:*0.71.1Vulnerableglpi-project
cpe:2.3:a:glpi-project:glpi:0.71.1:rc1:*:*:*:*:*:*0.71.1 rc1Vulnerableglpi-project
cpe:2.3:a:glpi-project:glpi:0.71.1:rc2:*:*:*:*:*:*0.71.1 rc2Vulnerableglpi-project
cpe:2.3:a:glpi-project:glpi:0.71.1:rc3:*:*:*:*:*:*0.71.1 rc3Vulnerableglpi-project
cpe:2.3:a:glpi-project:glpi:0.71.2:*:*:*:*:*:*:*0.71.2Vulnerableglpi-project
cpe:2.3:a:glpi-project:glpi:0.71.3:*:*:*:*:*:*:*0.71.3Vulnerableglpi-project
cpe:2.3:a:glpi-project:glpi:0.71.4:*:*:*:*:*:*:*0.71.4Vulnerableglpi-project
cpe:2.3:a:glpi-project:glpi:0.71.5:*:*:*:*:*:*:*0.71.5Vulnerableglpi-project
cpe:2.3:a:glpi-project:glpi:0.71.6:*:*:*:*:*:*:*0.71.6Vulnerableglpi-project
cpe:2.3:a:glpi-project:glpi:0.72:*:*:*:*:*:*:*0.72Vulnerableglpi-project
cpe:2.3:a:glpi-project:glpi:0.72:rc1:*:*:*:*:*:*0.72 rc1Vulnerableglpi-project
cpe:2.3:a:glpi-project:glpi:0.72:rc2:*:*:*:*:*:*0.72 rc2Vulnerableglpi-project
cpe:2.3:a:glpi-project:glpi:0.72:rc3:*:*:*:*:*:*0.72 rc3Vulnerableglpi-project
cpe:2.3:a:glpi-project:glpi:0.72.1:*:*:*:*:*:*:*0.72.1Vulnerableglpi-project
cpe:2.3:a:glpi-project:glpi:0.72.2:*:*:*:*:*:*:*0.72.2Vulnerableglpi-project
cpe:2.3:a:glpi-project:glpi:0.72.3:*:*:*:*:*:*:*0.72.3Vulnerableglpi-project
cpe:2.3:a:glpi-project:glpi:0.72.4:*:*:*:*:*:*:*0.72.4Vulnerableglpi-project
cpe:2.3:a:glpi-project:glpi:0.78:*:*:*:*:*:*:*0.78Vulnerableglpi-project
cpe:2.3:a:glpi-project:glpi:0.78.1:*:*:*:*:*:*:*0.78.1Vulnerableglpi-project
cpe:2.3:a:glpi-project:glpi:0.78.2:*:*:*:*:*:*:*0.78.2Vulnerableglpi-project
cpe:2.3:a:glpi-project:glpi:0.78.3:*:*:*:*:*:*:*0.78.3Vulnerableglpi-project
cpe:2.3:a:glpi-project:glpi:0.78.4:*:*:*:*:*:*:*0.78.4Vulnerableglpi-project
cpe:2.3:a:glpi-project:glpi:0.78.5:*:*:*:*:*:*:*0.78.5Vulnerableglpi-project
cpe:2.3:a:glpi-project:glpi:0.80:*:*:*:*:*:*:*0.80Vulnerableglpi-project
  • cpe:2.3:a:glpi-project:glpi:0.51a:*:*:*:*:*:*:* Versions 0.51a Vulnerable ·glpi-project
  • cpe:2.3:a:glpi-project:glpi:0.65:*:*:*:*:*:*:* Versions 0.65 Vulnerable ·glpi-project
  • cpe:2.3:a:glpi-project:glpi:0.65:rc1:*:*:*:*:*:* Versions 0.65 rc1 Vulnerable ·glpi-project
  • cpe:2.3:a:glpi-project:glpi:0.65:rc2:*:*:*:*:*:* Versions 0.65 rc2 Vulnerable ·glpi-project
  • cpe:2.3:a:glpi-project:glpi:0.68:*:*:*:*:*:*:* Versions 0.68 Vulnerable ·glpi-project
  • cpe:2.3:a:glpi-project:glpi:0.68:rc1:*:*:*:*:*:* Versions 0.68 rc1 Vulnerable ·glpi-project
  • cpe:2.3:a:glpi-project:glpi:0.68:rc2:*:*:*:*:*:* Versions 0.68 rc2 Vulnerable ·glpi-project
  • cpe:2.3:a:glpi-project:glpi:0.68:rc3:*:*:*:*:*:* Versions 0.68 rc3 Vulnerable ·glpi-project
  • cpe:2.3:a:glpi-project:glpi:0.68.1:*:*:*:*:*:*:* Versions 0.68.1 Vulnerable ·glpi-project
  • cpe:2.3:a:glpi-project:glpi:0.68.2:*:*:*:*:*:*:* Versions 0.68.2 Vulnerable ·glpi-project
  • cpe:2.3:a:glpi-project:glpi:0.68.3:*:*:*:*:*:*:* Versions 0.68.3 Vulnerable ·glpi-project
  • cpe:2.3:a:glpi-project:glpi:0.70:*:*:*:*:*:*:* Versions 0.70 Vulnerable ·glpi-project
  • cpe:2.3:a:glpi-project:glpi:0.70:rc1:*:*:*:*:*:* Versions 0.70 rc1 Vulnerable ·glpi-project
  • cpe:2.3:a:glpi-project:glpi:0.70:rc2:*:*:*:*:*:* Versions 0.70 rc2 Vulnerable ·glpi-project
  • cpe:2.3:a:glpi-project:glpi:0.70:rc3:*:*:*:*:*:* Versions 0.70 rc3 Vulnerable ·glpi-project
  • cpe:2.3:a:glpi-project:glpi:0.70.1:*:*:*:*:*:*:* Versions 0.70.1 Vulnerable ·glpi-project
  • cpe:2.3:a:glpi-project:glpi:0.70.2:*:*:*:*:*:*:* Versions 0.70.2 Vulnerable ·glpi-project
  • cpe:2.3:a:glpi-project:glpi:0.71:*:*:*:*:*:*:* Versions 0.71 Vulnerable ·glpi-project
  • cpe:2.3:a:glpi-project:glpi:0.71.1:*:*:*:*:*:*:* Versions 0.71.1 Vulnerable ·glpi-project
  • cpe:2.3:a:glpi-project:glpi:0.71.1:rc1:*:*:*:*:*:* Versions 0.71.1 rc1 Vulnerable ·glpi-project
  • cpe:2.3:a:glpi-project:glpi:0.71.1:rc2:*:*:*:*:*:* Versions 0.71.1 rc2 Vulnerable ·glpi-project
  • cpe:2.3:a:glpi-project:glpi:0.71.1:rc3:*:*:*:*:*:* Versions 0.71.1 rc3 Vulnerable ·glpi-project
  • cpe:2.3:a:glpi-project:glpi:0.71.2:*:*:*:*:*:*:* Versions 0.71.2 Vulnerable ·glpi-project
  • cpe:2.3:a:glpi-project:glpi:0.71.3:*:*:*:*:*:*:* Versions 0.71.3 Vulnerable ·glpi-project
  • cpe:2.3:a:glpi-project:glpi:0.71.4:*:*:*:*:*:*:* Versions 0.71.4 Vulnerable ·glpi-project
  • cpe:2.3:a:glpi-project:glpi:0.71.5:*:*:*:*:*:*:* Versions 0.71.5 Vulnerable ·glpi-project
  • cpe:2.3:a:glpi-project:glpi:0.71.6:*:*:*:*:*:*:* Versions 0.71.6 Vulnerable ·glpi-project
  • cpe:2.3:a:glpi-project:glpi:0.72:*:*:*:*:*:*:* Versions 0.72 Vulnerable ·glpi-project
  • cpe:2.3:a:glpi-project:glpi:0.72:rc1:*:*:*:*:*:* Versions 0.72 rc1 Vulnerable ·glpi-project
  • cpe:2.3:a:glpi-project:glpi:0.72:rc2:*:*:*:*:*:* Versions 0.72 rc2 Vulnerable ·glpi-project
  • cpe:2.3:a:glpi-project:glpi:0.72:rc3:*:*:*:*:*:* Versions 0.72 rc3 Vulnerable ·glpi-project
  • cpe:2.3:a:glpi-project:glpi:0.72.1:*:*:*:*:*:*:* Versions 0.72.1 Vulnerable ·glpi-project
  • cpe:2.3:a:glpi-project:glpi:0.72.2:*:*:*:*:*:*:* Versions 0.72.2 Vulnerable ·glpi-project
  • cpe:2.3:a:glpi-project:glpi:0.72.3:*:*:*:*:*:*:* Versions 0.72.3 Vulnerable ·glpi-project
  • cpe:2.3:a:glpi-project:glpi:0.72.4:*:*:*:*:*:*:* Versions 0.72.4 Vulnerable ·glpi-project
  • cpe:2.3:a:glpi-project:glpi:0.78:*:*:*:*:*:*:* Versions 0.78 Vulnerable ·glpi-project
  • cpe:2.3:a:glpi-project:glpi:0.78.1:*:*:*:*:*:*:* Versions 0.78.1 Vulnerable ·glpi-project
  • cpe:2.3:a:glpi-project:glpi:0.78.2:*:*:*:*:*:*:* Versions 0.78.2 Vulnerable ·glpi-project
  • cpe:2.3:a:glpi-project:glpi:0.78.3:*:*:*:*:*:*:* Versions 0.78.3 Vulnerable ·glpi-project
  • cpe:2.3:a:glpi-project:glpi:0.78.4:*:*:*:*:*:*:* Versions 0.78.4 Vulnerable ·glpi-project
  • cpe:2.3:a:glpi-project:glpi:0.78.5:*:*:*:*:*:*:* Versions 0.78.5 Vulnerable ·glpi-project
  • cpe:2.3:a:glpi-project:glpi:0.80:*:*:*:*:*:*:* Versions 0.80 Vulnerable ·glpi-project

Remediation

No fixed version listed by the sources yet.

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-02 Threatist record created from CVE-2011-2720
  2. 2026-10-03 Alias added: GHSA-v8g3-5fhj-q8xr

References

Patch 12

Advisory 3

Other 3

  • TI-2022-16341 /vendor/htmlawed/htmlawed/htmLawedTest.php in the htmlawed module for GLPI through 10.0.2 allows PHP code injection. KEVCVSS 3.1CRITICAL 9.8
  • TI-2025-18516 GLPI allows unauthenticated SQL injection through the inventory endpoint CVSS 3.1CRITICAL 9.8
  • TI-2023-25210 GLPI SQL injection through inventory agent request CVSS 3.1CRITICAL 9.8
  • TI-2023-17986 GLPI vulnerable to SQL injection via inventory agent request CVSS 3.1CRITICAL 9.8
  • TI-2022-13106 SQL injection on login page in GLPI CVSS 3.1CRITICAL 9.8
  • TI-2023-18602 GLPI vulnerable to SQL injection through Computer Virtual Machine information CVSS 3.1CRITICAL 9.8
See all 187 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences