Ubuntu.comUB:CVE-2024-27914CVE-2024-27914
5.3 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N
5.2 Medium
AI Score
Confidence
High
0.0004 Low
EPSS
Percentile
15.7%
GLPI is a Free Asset and IT Management Software package, Data center
management, ITIL Service Desk, licenses tracking and software auditing. An
unauthenticated user can provide a malicious link to a GLPI administrator
in order to exploit a reflected XSS vulnerability. The XSS will only
trigger if the administrator navigates through the debug bar. This issue
has been patched in version 10.0.13.
References
github.com/glpi-project/glpi/commit/69e0dee8de0c0df139b42dbfa1a8997888c2af95
github.com/glpi-project/glpi/releases/tag/10.0.13
github.com/glpi-project/glpi/security/advisories/GHSA-rcxj-fqr4-q34r
launchpad.net/bugs/cve/CVE-2024-27914
nvd.nist.gov/vuln/detail/CVE-2024-27914
security-tracker.debian.org/tracker/CVE-2024-27914
www.cve.org/CVERecord?id=CVE-2024-27914
Related
5.3 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N
5.2 Medium
AI Score
Confidence
High
0.0004 Low
EPSS
Percentile
15.7%