CVE-2020-11032 SQL injection on addme_observer and addme_assign in GLPI

In GLPI before version 9.4.6, there is a SQL injection vulnerability for all helpdesk instances. Exploiting this vulnerability requires a technician account. This is fixed in version 9.4.6...

CVE-2020-11032

GLPI has a SQL injection vulnerability (CVE-2020-11032) affecting all helpdesk instances in versions prior to 9.4.6. Exploitation requires a technician account. The issue is fixed in GLPI 9.4.6; upgrading to that version is the stated remediation. The CVE details are supported by multiple sources...

PT-2020-12504

Name of the Vulnerable Software and Affected Versions GLPI versions prior to 9.4.6 Description The issue concerns stored XSS vulnerabilities in the comments of items in the Knowledge base. An attack can be reproduced by adding a comment with malicious content, such as alert1. This can be exploite...

CVE-2020-11036: Improper Neutralization of Input During Web Page Generation

In GLPI before version 9.4.6 there are multiple related stored XSS vulnerabilities. The package is vulnerable to Stored XSS in the comments of items in the Knowledge base. Adding a comment with content " " reproduces the attack. This can be exploited by a user with administrator privileges in the...

PT-2020-12502

Name of the Vulnerable Software and Affected Versions GLPI versions prior to 9.4.6 Description The issue allows bypassing the open redirect protection based on a regexp. This enables potential redirection to unintended locations, potentially leading to phishing or other malicious activities. The...

PT-2020-12501

Name of the Vulnerable Software and Affected Versions GLPI versions 9.1 through 9.4.6 Description The issue allows any API user with READ right on User itemtype to access the full list of users when querying "apirest.php/User". The response contains all api tokens which can be used for privileges...

CVE-2020-11033: Exposure of Sensitive Information to an Unauthorized Actor

In GLPI from version 9.1 and before version 9.4.6, any API user with READ right on User itemtype will have access to full list of users when querying apirest.php/User. The response contains: - All apitokens which can be used to do privileges escalations or read/update/delete data normally non...

CVE-2020-11034: URL Redirection to Untrusted Site

In GLPI before version 9.4.6, there is a vulnerability that allows bypassing the open redirect protection based which is based on a regexp. This is fixed in version 9.4.6...

PT-2020-2710

Name of the Vulnerable Software and Affected Versions GLPI versions prior to 9.4.6 Description The issue is related to a SQL injection vulnerability in GLPI, which can be exploited by a remote attacker to gain unauthorized access to protected information using specially crafted SQL queries. This...

CVE-2020-11035: Use of a Broken or Risky Cryptographic Algorithm

In GLPI after version 0.83.3 and before version 9.4.6, the CSRF tokens are generated using an insecure algorithm. The implementation uses rand and uniqid and MD5 which does not provide secure values. This is fixed in version 9.4.6...

CVE-2020-11032: Improper Neutralization of Special Elements used in an SQL Command

In GLPI before version 9.4.6, there is a SQL injection vulnerability for all helpdesk instances. Exploiting this vulnerability requires a technician account. This is fixed in version 9.4.6...

PT-2020-12503

Name of the Vulnerable Software and Affected Versions GLPI versions 0.83.3 through 9.4.5 Description The issue concerns the generation of CSRF tokens using an insecure algorithm, which utilizes rand, uniqid, and MD5. This does not provide secure values. The problem is fixed in version 9.4.6...

glpi -- bypass of the open redirect protection

MITRE Corporation reports: In GLPI before version 9.4.6, there is a vulnerability that allows bypassing the open redirect protection based which is based on a regexp. This is fixed in version 9.4.6...

glpi -- Remote Code Execution (RCE) via the backup functionality

MITRE Corporation reports: In GLPI before 9.4.6, an attacker can execute system commands by abusing the backup functionality. Theoretically, this vulnerability can be exploited by an attacker without a valid account by using a CSRF. Due to the difficulty of the exploitation, the attack is only...

glpi -- weak csrf tokens

MITRE Corporation reports: In GLPI after version 0.83.3 and before version 9.4.6, the CSRF tokens are generated using an insecure algorithm. The implementation uses rand and uniqid and MD5 which does not provide secure values. This is fixed in version 9.4.6...

glpi -- Improve encryption algorithm

MITRE Corporation reports: In GLPI before version 9.5.0, the encryption algorithm used is insecure. The security of the data encrypted relies on the password used, if a user sets a weak/predictable password, an attacker could decrypt data. This is fixed in version 9.5.0 by using a more secure...

glpi -- Reflexive XSS in Dropdown menus

MITRE Corporation reports: In GLPI after 0.68.1 and before 9.4.6, multiple reflexive XSS occur in Dropdown endpoints due to an invalid Content-Type. This has been fixed in version 9.4.6...

glpi -- multiple related stored XSS vulnerabilities

MITRE Corporation reports: In GLPI before version 9.4.6 there are multiple related stored XSS vulnerabilities. The package is vulnerable to Stored XSS in the comments of items in the Knowledge base. Adding a comment with content "alert1" reproduces the attack. This can be exploited by a user with...

glpi -- able to read any token through API user endpoint

MITRE Corporation reports: In GLPI from version 9.1 and before version 9.4.6, any API user with READ right on User itemtype will have access to full list of users when querying apirest.php/User. The response contains: - All apitokens which can be used to do privileges escalations or...

glpi -- SQL injection for all helpdesk instances

MITRE Corporation reports: In GLPI before version 9.4.6, there is a SQL injection vulnerability for all helpdesk instances. Exploiting this vulnerability requires a technician account. This is fixed in version 9.4.6...