CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 0CVE-2021-21312 – Stored XSS on documents
https://notcve.org/view.php?id=CVE-2021-21312
GLPI is open source software which stands for Gestionnaire Libre de Parc Informatique and it is a Free Asset and IT Management Software package. In GLPI before verison 9.5.4, there is a vulnerability within the document upload function (Home > Management > Documents > Add, or /front/document.form.php endpoint), indeed one of the form field: "Web Link" is not properly sanitized and a malicious user (who has document upload rights) can use it to deliver JavaScript payload. For example if you use the following payload: " accesskey="x" onclick="alert(1)" x=", the content will be saved within the database without any control. And then once you return to the summary documents page, by clicking on the "Web Link" of the newly created file it will create a new empty tab, but on the initial tab the pop-up "1" will appear. GLPI es un software de código abierto que significa Gestionnaire Libre de Parc Informatique y es un paquete gratuito de Software de Gestión de Activos y TI. • https://github.com/glpi-project/glpi/releases/tag/9.5.4 https://github.com/glpi-project/glpi/security/advisories/GHSA-c7f6-3mr7-3rq2 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2021-21313 – XSS on tabs
https://notcve.org/view.php?id=CVE-2021-21313
GLPI is open source software which stands for Gestionnaire Libre de Parc Informatique and it is a Free Asset and IT Management Software package. In GLPI before verison 9.5.4, there is a vulnerability in the /ajax/common.tabs.php endpoint, indeed, at least two parameters _target and id are not properly sanitized. Here are two payloads (due to two different exploitations depending on which parameter you act) to exploit the vulnerability:/ajax/common.tabs.php?_target=javascript:alert(document.cookie)&_itemtype=DisplayPreference&_glpi_tab=DisplayPreference$2&id=258&displaytype=Ticket (Payload triggered if you click on the button). /ajax/common.tabs.php? • https://github.com/glpi-project/glpi/releases/tag/9.5.4 https://github.com/glpi-project/glpi/security/advisories/GHSA-h4hj-mrpg-xfgx • CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 0CVE-2020-27663
https://notcve.org/view.php?id=CVE-2020-27663
In GLPI before 9.5.3, ajax/getDropdownValue.php has an Insecure Direct Object Reference (IDOR) vulnerability that allows an attacker to read data from any itemType (e.g., Ticket, Users, etc.). En GLPI versiones anteriores a 9.5.3, el archivo ajax/getDropdownValue.php presenta una vulnerabilidad de Referencia Directa a Objetos No Segura (IDOR) que permite a un atacante leer datos de cualquier itemType (por ejemplo, Ticket, Users, etc.) • https://github.com/glpi-project/glpi/security/advisories/GHSA-pqfv-4pvr-55r4 • CWE-639: Authorization Bypass Through User-Controlled Key •
CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 0CVE-2020-27662
https://notcve.org/view.php?id=CVE-2020-27662
In GLPI before 9.5.3, ajax/comments.php has an Insecure Direct Object Reference (IDOR) vulnerability that allows an attacker to read data from any database table (e.g., glpi_tickets, glpi_users, etc.). En GLPI versiones anteriores a 9.5.3, el archivo ajax/comments.php, presenta una vulnerabilidad de Referencia Directa a Objetos No Segura (IDOR) que permite a un atacante leer datos de cualquier tabla de base de datos (por ejemplo, glpi_tickets, glpi_users, etc.) • https://github.com/glpi-project/glpi/security/advisories/GHSA-wq38-gwxp-8p5p • CWE-639: Authorization Bypass Through User-Controlled Key •
CVSS: 7.7EPSS: 0%CPEs: 1EXPL: 1CVE-2020-26212 – Any GLPI CalDAV calendars is read-only for every authenticated user
https://notcve.org/view.php?id=CVE-2020-26212
GLPI stands for Gestionnaire Libre de Parc Informatique and it is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. In GLPI before version 9.5.3, any authenticated user has read-only permissions to the planning of every other user, even admin ones. Steps to reproduce the behavior: 1. Create a new planning with 'eduardo.mozart' user (from 'IT' group that belongs to 'Super-admin') into it's personal planning at 'Assistance' > 'Planning'. 2. Copy the CalDAV url and use a CalDAV client (e.g. • https://github.com/glpi-project/glpi/commit/527280358ec78988ac57e9809d2eb21fcd74caf7 https://github.com/glpi-project/glpi/releases/tag/9.5.3 https://github.com/glpi-project/glpi/security/advisories/GHSA-qmw3-87hr-5wgx • CWE-862: Missing Authorization •