Security fix for the ALT Linux 10 package glpi version 9.5.4-alt1

March 31, 2021 Pavel Zilke 9.5.4-alt1 - New version 9.5.4 - This is a security release, upgrading is recommended - Security fixes: + CVE-2021-21326 : Horizontal Privilege Escalation + CVE-2021-21255 : entities switch IDOR + CVE-2021-21258 : XSS injection in ajax/kanban + CVE-2021-21314 : XSS...

CVE-2021-21324

Summary: CVE-2021-21324 affects GLPI up to version 9.5.3 (i.e., before 9.5.4). The issue is an Insecure Direct Object Reference (IDOR) in the knowbase search flow, allowing an authenticated attacker to enumerate GLPI item names (including user logins) by manipulating knowbaseitem.php query parame...