CVE-2020-15175

🗓️ 07 Oct 2020 18:45:14Reported by GitHub_MType

cve🔗 web.nvd.nist.gov📰️ 4 Media mentions👁 85 Views🌐 WEB

CVE-2020-15175: GLPI before 9.5.2 allows unauthorized access to sensitive dat

Reporter	Title	Published	Views	Family All 68
GithubExploit	Exploit for Files or Directories Accessible to External Parties in Glpi-Project Glpi	14 Mar 202213:51	–	githubexploit
FreeBSD	glpi -- Unauthenticated File Deletion	25 Jun 202000:00	–	freebsd
ALT Linux	Security fix for the ALT Linux 9 package glpi version 9.5.2-alt1	26 Oct 202000:00	–	altlinux
ALT Linux	Security fix for the ALT Linux 10 package glpi version 9.5.2-alt1	26 Oct 202000:00	–	altlinux
Circl	CVE-2020-15175	7 Oct 202022:29	–	circl
Cvelist	CVE-2020-15175 Unauthenticated File Deletion in GLPI	7 Oct 202018:45	–	cvelist
EUVD	EUVD-2020-7244	7 Oct 202500:30	–	euvd
Tenable Nessus	FreeBSD : glpi -- Unauthenticated File Deletion (675e5098-3b15-11eb-af2a-080027dbe4b7)	14 Dec 202000:00	–	nessus
Tenable Nessus	Linux Distros Unpatched Vulnerability : CVE-2020-15175	3 Sep 202500:00	–	nessus
NVD	CVE-2020-15175	7 Oct 202019:15	–	nvd

NVD

Vulners

Node

glpi-project glpiRange<9.5.2

[
  {
    "product": "glpi",
    "vendor": "glpi-project",
    "versions": [
      {
        "status": "affected",
        "version": "< 9.5.2"
      }
    ]
  }
]

Source	Link
github	www.github.com/glpi-project/glpi/commit/6ca9a0e77299a755c356d758344a23278df67f65
github	www.github.com/glpi-project/glpi/security/advisories/GHSA-rm52-jx9h-rwcp

Parameter	Position	Path	Description	CWE
image	request body	pluginimage.send.php	Endpoint allows crafting parameters to delete the .htaccess in /files, enabling read access to all files and folders.	CWE-552
plugin	request body	pluginimage.send.php	Endpoint allows crafting parameters to delete the .htaccess in /files, enabling read access to all files and folders.	CWE-552

17 Jun 2026 02:56Current

7.9High risk

Vulners AI Score7.9

CVSS 26.4

CVSS 3.17.4 - 9.1

EPSS0.71352

CWE-552