Read the docs
TI-2020-04304 Aliases CVE-2020-5248

Public GLPIKEY can be used to decrypt any data in GLPI

Priority LOW 35CWE-798Published · Updated

Key facts

Attack vector
Local
Privileges required
High
User interaction
None
Attack complexity
High
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-798.

Summary

GLPI before before version 9.4.6 has a vulnerability involving a default encryption key. GLPIKEY is public and is used on every instance. This means anyone can decrypt sensitive data stored using this key. It is possible to change the key before installing GLPI. But on existing instances, data must be reencrypted with the new key. Problem is we can not know which columns or rows in the database are using that; espcially from plugins. Changing the key without updating data would lend in bad password sent from glpi; but storing them again from the UI will work.

Why it matters now

EPSS 0.01529 74th percentileScored 2026-11-07
Fix Fixed glpi (glpi-project): 9.4.6

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
glpi-projectglpibefore 9.4.69.4.6Patch availableCNA
  • glpi Vendorglpi-project Affected before 9.4.6 Fixed in 9.4.6 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:glpi-project:glpi:*:*:*:*:*:*:*:*before 9.4.6Vulnerableglpi-project
  • cpe:2.3:a:glpi-project:glpi:*:*:*:*:*:*:*:* Versions before 9.4.6 Vulnerable ·glpi-project

Remediation

  • Fix · CNA glpi (glpi-project) Fixed in 9.4.6

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-5248

References

Patch 1

Advisory 1

  • TI-2022-16341 /vendor/htmlawed/htmlawed/htmLawedTest.php in the htmlawed module for GLPI through 10.0.2 allows PHP code injection. KEVCVSS 3.1CRITICAL 9.8
  • TI-2025-18516 GLPI allows unauthenticated SQL injection through the inventory endpoint CVSS 3.1CRITICAL 9.8
  • TI-2023-25210 GLPI SQL injection through inventory agent request CVSS 3.1CRITICAL 9.8
  • TI-2023-17986 GLPI vulnerable to SQL injection via inventory agent request CVSS 3.1CRITICAL 9.8
  • TI-2022-13106 SQL injection on login page in GLPI CVSS 3.1CRITICAL 9.8
  • TI-2023-18602 GLPI vulnerable to SQL injection through Computer Virtual Machine information CVSS 3.1CRITICAL 9.8
See all 187 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences