CVSS: 9.1EPSS: 0%CPEs: 1EXPL: 0CVE-2020-15175 – Unauthenticated File Deletion in GLPI
https://notcve.org/view.php?id=CVE-2020-15175
In GLPI before version 9.5.2, the `pluginimage.send.php` endpoint allows a user to specify an image from a plugin. The parameters can be maliciously crafted to instead delete the .htaccess file for the files directory. Any user becomes able to read all the files and folders contained in “/files/”. Some of the sensitive information that is compromised are the user sessions, logs, and more. An attacker would be able to get the Administrators session token and use that to authenticate. • https://github.com/glpi-project/glpi/commit/6ca9a0e77299a755c356d758344a23278df67f65 https://github.com/glpi-project/glpi/security/advisories/GHSA-rm52-jx9h-rwcp • CWE-552: Files or Directories Accessible to External Parties •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2020-11031 – Insecure encryption algorithm in GLPI
https://notcve.org/view.php?id=CVE-2020-11031
In GLPI before version 9.5.0, the encryption algorithm used is insecure. The security of the data encrypted relies on the password used, if a user sets a weak/predictable password, an attacker could decrypt data. This is fixed in version 9.5.0 by using a more secure encryption library. The library chosen is sodium. En GLPI versiones anteriores a 9.5.0, el algoritmo de cifrado usado no es seguro. • https://github.com/glpi-project/glpi/commit/f1ae6c8481e5c19a6f1801a5548cada45702e01a#diff-b5d0ee8c97c7abd7e3fa29b9a27d1780 https://github.com/glpi-project/glpi/security/advisories/GHSA-7xwm-4vjr-jvqh • CWE-327: Use of a Broken or Risky Cryptographic Algorithm •
CVSS: 7.1EPSS: 0%CPEs: 1EXPL: 0CVE-2020-15108 – SQL Injection in glpi
https://notcve.org/view.php?id=CVE-2020-15108
In glpi before 9.5.1, there is a SQL injection for all usages of "Clone" feature. This has been fixed in 9.5.1. En glpi versiones anteriores a 9.5.1, se presenta una inyección SQL para todos los usos de la funcionalidad "Clone". Esto ha sido corregido en 9.5.1 • https://github.com/glpi-project/glpi/commit/a4baa64114eb92fd2adf6056a36e0582324414ba https://github.com/glpi-project/glpi/pull/6684 https://github.com/glpi-project/glpi/security/advisories/GHSA-qv6w-68gq-wx2v • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 9.0EPSS: 0%CPEs: 1EXPL: 2CVE-2020-11060 – Remote Code Execution in GLPI
https://notcve.org/view.php?id=CVE-2020-11060
In GLPI before 9.4.6, an attacker can execute system commands by abusing the backup functionality. Theoretically, this vulnerability can be exploited by an attacker without a valid account by using a CSRF. Due to the difficulty of the exploitation, the attack is only conceivable by an account having Maintenance privileges and the right to add WIFI networks. This is fixed in version 9.4.6. En GLPI versiones anteriores a 9.4.6, un atacante puede ejecutar comandos del sistema al abusar de la funcionalidad backup. • https://www.exploit-db.com/exploits/49992 https://www.exploit-db.com/exploits/51726 http://packetstormsecurity.com/files/163119/GLPI-9.4.5-Remote-Code-Execution.html https://github.com/glpi-project/glpi/commit/ad748d59c94da177a3ed25111c453902396f320c https://github.com/glpi-project/glpi/security/advisories/GHSA-cvvq-3fww-5v6f • CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 7.2EPSS: 0%CPEs: 1EXPL: 2CVE-2020-5248 – Public GLPIKEY can be used to decrypt any data in GLPI
https://notcve.org/view.php?id=CVE-2020-5248
GLPI before before version 9.4.6 has a vulnerability involving a default encryption key. GLPIKEY is public and is used on every instance. This means anyone can decrypt sensitive data stored using this key. It is possible to change the key before installing GLPI. But on existing instances, data must be reencrypted with the new key. • https://github.com/indevi0us/CVE-2020-5248 https://github.com/Mkway/CVE-2020-5248 https://github.com/glpi-project/glpi/commit/efd14468c92c4da43333aa9735e65fd20cbc7c6c https://github.com/glpi-project/glpi/security/advisories/GHSA-j222-j9mf-h6j9 • CWE-798: Use of Hard-coded Credentials •