CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2021-21313 – XSS on tabs
https://notcve.org/view.php?id=CVE-2021-21313
GLPI is open source software which stands for Gestionnaire Libre de Parc Informatique and it is a Free Asset and IT Management Software package. In GLPI before verison 9.5.4, there is a vulnerability in the /ajax/common.tabs.php endpoint, indeed, at least two parameters _target and id are not properly sanitized. Here are two payloads (due to two different exploitations depending on which parameter you act) to exploit the vulnerability:/ajax/common.tabs.php?_target=javascript:alert(document.cookie)&_itemtype=DisplayPreference&_glpi_tab=DisplayPreference$2&id=258&displaytype=Ticket (Payload triggered if you click on the button). /ajax/common.tabs.php? • https://github.com/glpi-project/glpi/releases/tag/9.5.4 https://github.com/glpi-project/glpi/security/advisories/GHSA-h4hj-mrpg-xfgx • CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.8EPSS: 0%CPEs: 1EXPL: 0CVE-2021-21258 – XSS injection in ajax/kanban
https://notcve.org/view.php?id=CVE-2021-21258
GLPI is an open-source asset and IT management software package that provides ITIL Service Desk features, licenses tracking and software auditing. In GLPI from version 9.5.0 and before version 9.5.4, there is a cross-site scripting injection vulnerability when using ajax/kanban.php. This is fixed in version 9.5.4. GLPI es un paquete de software de gestión de activos y TI de código abierto que proporciona funciones de ITIL Service Desk, seguimiento de licencias y auditoría de software. En GLPI desde la versión 9.5.0 y anterior a la versión 9.5.4, se presenta una vulnerabilidad de inyección de tipo cross-site scripting cuando se usa el archivo ajax/kanban.php. • https://github.com/glpi-project/glpi/commit/e7802fc051696de1f76108ea8dc3bd4e2c880f15 https://github.com/glpi-project/glpi/security/advisories/GHSA-j4xj-4qmc-mmmx • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.8EPSS: 0%CPEs: 1EXPL: 0CVE-2021-21255 – entities switch IDOR
https://notcve.org/view.php?id=CVE-2021-21255
GLPI is an open-source asset and IT management software package that provides ITIL Service Desk features, licenses tracking and software auditing. In GLPI version 9.5.3, it was possible to switch entities with IDOR from a logged in user. This is fixed in version 9.5.4. GLPI es un paquete de software de gestión de activos y TI de código abierto que proporciona funciones de ITIL Service Desk, seguimiento de licencias y auditoría de software. En GLPI versión 9.5.3, era posible cambiar entidades con IDOR desde un usuario que había iniciado sesión. • https://github.com/glpi-project/glpi/commit/aade65b7f67d46f23d276a8acb0df70651c3b1dc https://github.com/glpi-project/glpi/security/advisories/GHSA-v3m5-r3mx-ff9j • CWE-639: Authorization Bypass Through User-Controlled Key CWE-862: Missing Authorization •
CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 0CVE-2020-27663
https://notcve.org/view.php?id=CVE-2020-27663
In GLPI before 9.5.3, ajax/getDropdownValue.php has an Insecure Direct Object Reference (IDOR) vulnerability that allows an attacker to read data from any itemType (e.g., Ticket, Users, etc.). En GLPI versiones anteriores a 9.5.3, el archivo ajax/getDropdownValue.php presenta una vulnerabilidad de Referencia Directa a Objetos No Segura (IDOR) que permite a un atacante leer datos de cualquier itemType (por ejemplo, Ticket, Users, etc.) • https://github.com/glpi-project/glpi/security/advisories/GHSA-pqfv-4pvr-55r4 • CWE-639: Authorization Bypass Through User-Controlled Key •
CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 0CVE-2020-27662
https://notcve.org/view.php?id=CVE-2020-27662
In GLPI before 9.5.3, ajax/comments.php has an Insecure Direct Object Reference (IDOR) vulnerability that allows an attacker to read data from any database table (e.g., glpi_tickets, glpi_users, etc.). En GLPI versiones anteriores a 9.5.3, el archivo ajax/comments.php, presenta una vulnerabilidad de Referencia Directa a Objetos No Segura (IDOR) que permite a un atacante leer datos de cualquier tabla de base de datos (por ejemplo, glpi_tickets, glpi_users, etc.) • https://github.com/glpi-project/glpi/security/advisories/GHSA-wq38-gwxp-8p5p • CWE-639: Authorization Bypass Through User-Controlled Key •