4.5 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
HIGH
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N
6.4 Medium
AI Score
Confidence
High
0.0004 Low
EPSS
Percentile
15.7%
GLPI is a Free Asset and IT Management Software package, Data center
management, ITIL Service Desk, licenses tracking and software auditing. A
user with rights to create and share dashboards can build a dashboard
containing javascript code. Any user that will open this dashboard will be
subject to an XSS attack. This issue has been patched in version 10.0.13.
github.com/glpi-project/glpi/commit/b409ca437864607b03c2014b9e3293b7f141af65
github.com/glpi-project/glpi/releases/tag/10.0.13
github.com/glpi-project/glpi/security/advisories/GHSA-prc3-cx5m-h5mj
launchpad.net/bugs/cve/CVE-2024-27104
nvd.nist.gov/vuln/detail/CVE-2024-27104
security-tracker.debian.org/tracker/CVE-2024-27104
www.cve.org/CVERecord?id=CVE-2024-27104
4.5 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
HIGH
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N
6.4 Medium
AI Score
Confidence
High
0.0004 Low
EPSS
Percentile
15.7%