Linux Distros Unpatched Vulnerability : CVE-2020-15175

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In GLPI before version 9.5.2, the pluginimage.send.php endpoint allows a user to specify an image from a plugin. The parameters can be maliciously crafted to...

CVE-2020-15175

In GLPI before version 9.5.2, the ​pluginimage.send.php​ endpoint allows a user to specify an image from a plugin. The parameters can be maliciously crafted to instead delete the .htaccess file for the files directory. Any user becomes able to read all the files and folders contained in “/files/”...

CVE-2020-15175

CVE-2020-15175 affects GLPI prior to 9.5.2, where the pluginimage.send.php endpoint can be abused to delete the .htaccess in /files/, enabling reading of files/folders and exposing sensitive data (including potential session tokens). The issue is explicitly stated as patched in GLPI 9.5.2. Connec...

CVE-2020-15175 Unauthenticated File Deletion in GLPI

In GLPI before version 9.5.2, the ​pluginimage.send.php​ endpoint allows a user to specify an image from a plugin. The parameters can be maliciously crafted to instead delete the .htaccess file for the files directory. Any user becomes able to read all the files and folders contained in “/files/”...