CVSS: 9.0EPSS: 0%CPEs: 1EXPL: 2CVE-2020-11060 – Remote Code Execution in GLPI
https://notcve.org/view.php?id=CVE-2020-11060
In GLPI before 9.4.6, an attacker can execute system commands by abusing the backup functionality. Theoretically, this vulnerability can be exploited by an attacker without a valid account by using a CSRF. Due to the difficulty of the exploitation, the attack is only conceivable by an account having Maintenance privileges and the right to add WIFI networks. This is fixed in version 9.4.6. En GLPI versiones anteriores a 9.4.6, un atacante puede ejecutar comandos del sistema al abusar de la funcionalidad backup. • https://www.exploit-db.com/exploits/49992 https://www.exploit-db.com/exploits/51726 http://packetstormsecurity.com/files/163119/GLPI-9.4.5-Remote-Code-Execution.html https://github.com/glpi-project/glpi/commit/ad748d59c94da177a3ed25111c453902396f320c https://github.com/glpi-project/glpi/security/advisories/GHSA-cvvq-3fww-5v6f • CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 6.0EPSS: 0%CPEs: 1EXPL: 0CVE-2020-11062 – Reflexive XSS in GLPI
https://notcve.org/view.php?id=CVE-2020-11062
In GLPI after 0.68.1 and before 9.4.6, multiple reflexive XSS occur in Dropdown endpoints due to an invalid Content-Type. This has been fixed in version 9.4.6. En GLPI versiones posteriores a 0.68.1 y anteriores a 9.4.6, se producen múltiples ataques de tipo XSS reflexivos en los endpoints Dropdown debido a un Content-Type no válido. Esto ha sido corregido en la versión 9.4.6. • https://github.com/glpi-project/glpi/commit/5e1c52c5e8a30ceb4e9572964da7ed89ddfb1aaf https://github.com/glpi-project/glpi/security/advisories/GHSA-3xxh-f5p2-jg3h • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.2EPSS: 0%CPEs: 1EXPL: 2CVE-2020-5248 – Public GLPIKEY can be used to decrypt any data in GLPI
https://notcve.org/view.php?id=CVE-2020-5248
GLPI before before version 9.4.6 has a vulnerability involving a default encryption key. GLPIKEY is public and is used on every instance. This means anyone can decrypt sensitive data stored using this key. It is possible to change the key before installing GLPI. But on existing instances, data must be reencrypted with the new key. • https://github.com/indevi0us/CVE-2020-5248 https://github.com/Mkway/CVE-2020-5248 https://github.com/glpi-project/glpi/commit/efd14468c92c4da43333aa9735e65fd20cbc7c6c https://github.com/glpi-project/glpi/security/advisories/GHSA-j222-j9mf-h6j9 • CWE-798: Use of Hard-coded Credentials •
CVSS: 7.6EPSS: 0%CPEs: 1EXPL: 1CVE-2020-11036 – XSS in GLPI
https://notcve.org/view.php?id=CVE-2020-11036
In GLPI before version 9.4.6 there are multiple related stored XSS vulnerabilities. The package is vulnerable to Stored XSS in the comments of items in the Knowledge base. Adding a comment with content "<script>alert(1)</script>" reproduces the attack. This can be exploited by a user with administrator privileges in the User-Agent field. It can also be exploited by an outside party through the following steps: 1. • https://github.com/glpi-project/glpi/security/advisories/GHSA-3g3h-rwhr-7385 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5WQMONZRWLWOXMHMYWR7A5Q5JJERPMVC https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Q4BG2UTINBVV7MTJRXKBQ26GV2UINA6L • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2020-11034 – bypass of manageRedirect in GLPI
https://notcve.org/view.php?id=CVE-2020-11034
In GLPI before version 9.4.6, there is a vulnerability that allows bypassing the open redirect protection based which is based on a regexp. This is fixed in version 9.4.6. En GLPI versiones anteriores a 9.4.6, se presenta una vulnerabilidad que permite omitir la protección de redireccionamiento abierto el cual es basada en un regexp. Esto es corregido en la versión 9.4.6. • https://github.com/glpi-project/glpi/security/advisories/GHSA-gxv6-xq9q-37hg https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5WQMONZRWLWOXMHMYWR7A5Q5JJERPMVC https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Q4BG2UTINBVV7MTJRXKBQ26GV2UINA6L • CWE-185: Incorrect Regular Expression CWE-601: URL Redirection to Untrusted Site ('Open Redirect') •