CVE-2020-15177

In GLPI before version 9.5.2, the install/install.php endpoint insecurely stores user input into the database as urlbase and urlbaseapi. These settings are referenced throughout the application and allow for vulnerabilities like Cross-Site Scripting and Insecure Redirection Since authentication i...

CVE-2020-15177

GLPI prior to 9.5.2 is vulnerable due to install/install.php storing user input into url_base/url_base_api, enabling XSS and insecure redirection without authentication; patch to 9.5.2 or later.

CVE-2020-15177 Unauthenticated Stored XSS in GLPI

In GLPI before version 9.5.2, the install/install.php endpoint insecurely stores user input into the database as urlbase and urlbaseapi. These settings are referenced throughout the application and allow for vulnerabilities like Cross-Site Scripting and Insecure Redirection Since authentication i...