Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

4 records

Advisory: glpi-project GLPI — FEDORA-2020-885e2343ed Clear all filters
TI-2020-08910 CVE-2020-11036

Cross-site scripting in glpi-project GLPI

Priority LOW 35

In GLPI before version 9.4.6 there are multiple related stored XSS vulnerabilities.

CVSS 3.1HIGH 7.6 Network Low privileges User interaction EPSS 0.00804 Published 2020-05-05 Fixed in 9.4.6 CWE-79
TI-2020-08909 CVE-2020-11035

weak CSRF tokens in GLPI

Priority MEDIUM 42

In GLPI after version 0.83.3 and before version 9.4.6, the CSRF tokens are generated using an insecure algorithm.

CVSS 3.1CRITICAL 9.3 Network No auth No interaction EPSS 0.00898 Published 2020-05-05 No fix listed CWE-327
TI-2020-08908 CVE-2020-11034

bypass of manageRedirect in GLPI

Priority LOW 38

In GLPI before version 9.4.6, there is a vulnerability that allows bypassing the open redirect protection based which is based on a regexp.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.07574 Published 2020-05-05 Fixed in 9.4.6 CWE-185
TI-2020-08907 CVE-2020-11033

Able to read any token through API user endpoint in GLPI

Priority LOW 34

In GLPI from version 9.1 and before version 9.4.6, any API user with READ right on User itemtype will have access to full list of users when querying apirest.php/User.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.01038 Published 2020-05-05 No fix listed CWE-200