CVSS: 9.1EPSS: 0%CPEs: 1EXPL: 0CVE-2020-15175 – Unauthenticated File Deletion in GLPI
https://notcve.org/view.php?id=CVE-2020-15175
In GLPI before version 9.5.2, the `pluginimage.send.php` endpoint allows a user to specify an image from a plugin. The parameters can be maliciously crafted to instead delete the .htaccess file for the files directory. Any user becomes able to read all the files and folders contained in “/files/”. Some of the sensitive information that is compromised are the user sessions, logs, and more. An attacker would be able to get the Administrators session token and use that to authenticate. • https://github.com/glpi-project/glpi/commit/6ca9a0e77299a755c356d758344a23278df67f65 https://github.com/glpi-project/glpi/security/advisories/GHSA-rm52-jx9h-rwcp • CWE-552: Files or Directories Accessible to External Parties •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2020-11031 – Insecure encryption algorithm in GLPI
https://notcve.org/view.php?id=CVE-2020-11031
In GLPI before version 9.5.0, the encryption algorithm used is insecure. The security of the data encrypted relies on the password used, if a user sets a weak/predictable password, an attacker could decrypt data. This is fixed in version 9.5.0 by using a more secure encryption library. The library chosen is sodium. En GLPI versiones anteriores a 9.5.0, el algoritmo de cifrado usado no es seguro. • https://github.com/glpi-project/glpi/commit/f1ae6c8481e5c19a6f1801a5548cada45702e01a#diff-b5d0ee8c97c7abd7e3fa29b9a27d1780 https://github.com/glpi-project/glpi/security/advisories/GHSA-7xwm-4vjr-jvqh • CWE-327: Use of a Broken or Risky Cryptographic Algorithm •
CVSS: 7.1EPSS: 0%CPEs: 1EXPL: 0CVE-2020-15108 – SQL Injection in glpi
https://notcve.org/view.php?id=CVE-2020-15108
In glpi before 9.5.1, there is a SQL injection for all usages of "Clone" feature. This has been fixed in 9.5.1. En glpi versiones anteriores a 9.5.1, se presenta una inyección SQL para todos los usos de la funcionalidad "Clone". Esto ha sido corregido en 9.5.1 • https://github.com/glpi-project/glpi/commit/a4baa64114eb92fd2adf6056a36e0582324414ba https://github.com/glpi-project/glpi/pull/6684 https://github.com/glpi-project/glpi/security/advisories/GHSA-qv6w-68gq-wx2v • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 9.0EPSS: 0%CPEs: 1EXPL: 2CVE-2020-11060 – Remote Code Execution in GLPI
https://notcve.org/view.php?id=CVE-2020-11060
In GLPI before 9.4.6, an attacker can execute system commands by abusing the backup functionality. Theoretically, this vulnerability can be exploited by an attacker without a valid account by using a CSRF. Due to the difficulty of the exploitation, the attack is only conceivable by an account having Maintenance privileges and the right to add WIFI networks. This is fixed in version 9.4.6. En GLPI versiones anteriores a 9.4.6, un atacante puede ejecutar comandos del sistema al abusar de la funcionalidad backup. • https://www.exploit-db.com/exploits/49992 https://www.exploit-db.com/exploits/51726 http://packetstormsecurity.com/files/163119/GLPI-9.4.5-Remote-Code-Execution.html https://github.com/glpi-project/glpi/commit/ad748d59c94da177a3ed25111c453902396f320c https://github.com/glpi-project/glpi/security/advisories/GHSA-cvvq-3fww-5v6f • CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 6.0EPSS: 0%CPEs: 1EXPL: 0CVE-2020-11062 – Reflexive XSS in GLPI
https://notcve.org/view.php?id=CVE-2020-11062
In GLPI after 0.68.1 and before 9.4.6, multiple reflexive XSS occur in Dropdown endpoints due to an invalid Content-Type. This has been fixed in version 9.4.6. En GLPI versiones posteriores a 0.68.1 y anteriores a 9.4.6, se producen múltiples ataques de tipo XSS reflexivos en los endpoints Dropdown debido a un Content-Type no válido. Esto ha sido corregido en la versión 9.4.6. • https://github.com/glpi-project/glpi/commit/5e1c52c5e8a30ceb4e9572964da7ed89ddfb1aaf https://github.com/glpi-project/glpi/security/advisories/GHSA-3xxh-f5p2-jg3h • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •