CVSS: 8.7EPSS: 0%CPEs: 1EXPL: 0CVE-2020-15176 – SQL injection in GLPI
https://notcve.org/view.php?id=CVE-2020-15176
In GLPI before version 9.5.2, when supplying a back tick in input that gets put into a SQL query,the application does not escape or sanitize allowing for SQL Injection to occur. Leveraging this vulnerability an attacker is able to exfiltrate sensitive information like passwords, reset tokens, personal details, and more. The issue is patched in version 9.5.2 En GLPI versiones anteriores a 9.5.2, cuando se suministra un back tick en la entrada que se coloca en una consulta SQL, la aplicación no escapa ni se sanea, permitiendo que ocurra una inyección SQL. Al aprovechar esta vulnerabilidad, un atacante es capaz de exfiltrar información confidencial como contraseñas, tokens de restablecimiento, detalles personales y más. El problema es parcheado en la versión 9.5.2 • https://github.com/glpi-project/glpi/commit/f021f1f365b4acea5066d3e57c6d22658cf32575 https://github.com/glpi-project/glpi/security/advisories/GHSA-x93w-64x9-58qw • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 9.1EPSS: 0%CPEs: 1EXPL: 0CVE-2020-15175 – Unauthenticated File Deletion in GLPI
https://notcve.org/view.php?id=CVE-2020-15175
In GLPI before version 9.5.2, the `pluginimage.send.php` endpoint allows a user to specify an image from a plugin. The parameters can be maliciously crafted to instead delete the .htaccess file for the files directory. Any user becomes able to read all the files and folders contained in “/files/”. Some of the sensitive information that is compromised are the user sessions, logs, and more. An attacker would be able to get the Administrators session token and use that to authenticate. • https://github.com/glpi-project/glpi/commit/6ca9a0e77299a755c356d758344a23278df67f65 https://github.com/glpi-project/glpi/security/advisories/GHSA-rm52-jx9h-rwcp • CWE-552: Files or Directories Accessible to External Parties •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2020-11031 – Insecure encryption algorithm in GLPI
https://notcve.org/view.php?id=CVE-2020-11031
In GLPI before version 9.5.0, the encryption algorithm used is insecure. The security of the data encrypted relies on the password used, if a user sets a weak/predictable password, an attacker could decrypt data. This is fixed in version 9.5.0 by using a more secure encryption library. The library chosen is sodium. En GLPI versiones anteriores a 9.5.0, el algoritmo de cifrado usado no es seguro. • https://github.com/glpi-project/glpi/commit/f1ae6c8481e5c19a6f1801a5548cada45702e01a#diff-b5d0ee8c97c7abd7e3fa29b9a27d1780 https://github.com/glpi-project/glpi/security/advisories/GHSA-7xwm-4vjr-jvqh • CWE-327: Use of a Broken or Risky Cryptographic Algorithm •
CVSS: 7.1EPSS: 0%CPEs: 1EXPL: 0CVE-2020-15108 – SQL Injection in glpi
https://notcve.org/view.php?id=CVE-2020-15108
In glpi before 9.5.1, there is a SQL injection for all usages of "Clone" feature. This has been fixed in 9.5.1. En glpi versiones anteriores a 9.5.1, se presenta una inyección SQL para todos los usos de la funcionalidad "Clone". Esto ha sido corregido en 9.5.1 • https://github.com/glpi-project/glpi/commit/a4baa64114eb92fd2adf6056a36e0582324414ba https://github.com/glpi-project/glpi/pull/6684 https://github.com/glpi-project/glpi/security/advisories/GHSA-qv6w-68gq-wx2v • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 9.0EPSS: 0%CPEs: 1EXPL: 2CVE-2020-11060 – Remote Code Execution in GLPI
https://notcve.org/view.php?id=CVE-2020-11060
In GLPI before 9.4.6, an attacker can execute system commands by abusing the backup functionality. Theoretically, this vulnerability can be exploited by an attacker without a valid account by using a CSRF. Due to the difficulty of the exploitation, the attack is only conceivable by an account having Maintenance privileges and the right to add WIFI networks. This is fixed in version 9.4.6. En GLPI versiones anteriores a 9.4.6, un atacante puede ejecutar comandos del sistema al abusar de la funcionalidad backup. • https://www.exploit-db.com/exploits/49992 https://www.exploit-db.com/exploits/51726 http://packetstormsecurity.com/files/163119/GLPI-9.4.5-Remote-Code-Execution.html https://github.com/glpi-project/glpi/commit/ad748d59c94da177a3ed25111c453902396f320c https://github.com/glpi-project/glpi/security/advisories/GHSA-cvvq-3fww-5v6f • CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') CWE-352: Cross-Site Request Forgery (CSRF) •