Security fix for the ALT Linux 10 package glpi version 9.5.4-alt1

March 31, 2021 Pavel Zilke 9.5.4-alt1 - New version 9.5.4 - This is a security release, upgrading is recommended - Security fixes: + CVE-2021-21326 : Horizontal Privilege Escalation + CVE-2021-21255 : entities switch IDOR + CVE-2021-21258 : XSS injection in ajax/kanban + CVE-2021-21314 : XSS...

CVE-2021-21312

GLPI prior to 9.5.4 is affected by an XSS via the document upload Web Link field; unsanitized input can store JavaScript in the DB and execute when the link is opened. The vulnerability requires document-upload rights and results in popup execution or similar impact. Remediation: upgrade to GLPI ...

CVE-2021-21312 Stored XSS on documents

GLPI is open source software which stands for Gestionnaire Libre de Parc Informatique and it is a Free Asset and IT Management Software package. In GLPI before verison 9.5.4, there is a vulnerability within the document upload function Home Management Documents Add, or /front/document.form.php...