CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 0CVE-2021-21312 – Stored XSS on documents
https://notcve.org/view.php?id=CVE-2021-21312
GLPI is open source software which stands for Gestionnaire Libre de Parc Informatique and it is a Free Asset and IT Management Software package. In GLPI before verison 9.5.4, there is a vulnerability within the document upload function (Home > Management > Documents > Add, or /front/document.form.php endpoint), indeed one of the form field: "Web Link" is not properly sanitized and a malicious user (who has document upload rights) can use it to deliver JavaScript payload. For example if you use the following payload: " accesskey="x" onclick="alert(1)" x=", the content will be saved within the database without any control. And then once you return to the summary documents page, by clicking on the "Web Link" of the newly created file it will create a new empty tab, but on the initial tab the pop-up "1" will appear. GLPI es un software de código abierto que significa Gestionnaire Libre de Parc Informatique y es un paquete gratuito de Software de Gestión de Activos y TI. • https://github.com/glpi-project/glpi/releases/tag/9.5.4 https://github.com/glpi-project/glpi/security/advisories/GHSA-c7f6-3mr7-3rq2 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2021-21313 – XSS on tabs
https://notcve.org/view.php?id=CVE-2021-21313
GLPI is open source software which stands for Gestionnaire Libre de Parc Informatique and it is a Free Asset and IT Management Software package. In GLPI before verison 9.5.4, there is a vulnerability in the /ajax/common.tabs.php endpoint, indeed, at least two parameters _target and id are not properly sanitized. Here are two payloads (due to two different exploitations depending on which parameter you act) to exploit the vulnerability:/ajax/common.tabs.php?_target=javascript:alert(document.cookie)&_itemtype=DisplayPreference&_glpi_tab=DisplayPreference$2&id=258&displaytype=Ticket (Payload triggered if you click on the button). /ajax/common.tabs.php? • https://github.com/glpi-project/glpi/releases/tag/9.5.4 https://github.com/glpi-project/glpi/security/advisories/GHSA-h4hj-mrpg-xfgx • CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.8EPSS: 0%CPEs: 1EXPL: 0CVE-2021-21258 – XSS injection in ajax/kanban
https://notcve.org/view.php?id=CVE-2021-21258
GLPI is an open-source asset and IT management software package that provides ITIL Service Desk features, licenses tracking and software auditing. In GLPI from version 9.5.0 and before version 9.5.4, there is a cross-site scripting injection vulnerability when using ajax/kanban.php. This is fixed in version 9.5.4. GLPI es un paquete de software de gestión de activos y TI de código abierto que proporciona funciones de ITIL Service Desk, seguimiento de licencias y auditoría de software. En GLPI desde la versión 9.5.0 y anterior a la versión 9.5.4, se presenta una vulnerabilidad de inyección de tipo cross-site scripting cuando se usa el archivo ajax/kanban.php. • https://github.com/glpi-project/glpi/commit/e7802fc051696de1f76108ea8dc3bd4e2c880f15 https://github.com/glpi-project/glpi/security/advisories/GHSA-j4xj-4qmc-mmmx • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.8EPSS: 0%CPEs: 1EXPL: 0CVE-2021-21255 – entities switch IDOR
https://notcve.org/view.php?id=CVE-2021-21255
GLPI is an open-source asset and IT management software package that provides ITIL Service Desk features, licenses tracking and software auditing. In GLPI version 9.5.3, it was possible to switch entities with IDOR from a logged in user. This is fixed in version 9.5.4. GLPI es un paquete de software de gestión de activos y TI de código abierto que proporciona funciones de ITIL Service Desk, seguimiento de licencias y auditoría de software. En GLPI versión 9.5.3, era posible cambiar entidades con IDOR desde un usuario que había iniciado sesión. • https://github.com/glpi-project/glpi/commit/aade65b7f67d46f23d276a8acb0df70651c3b1dc https://github.com/glpi-project/glpi/security/advisories/GHSA-v3m5-r3mx-ff9j • CWE-639: Authorization Bypass Through User-Controlled Key CWE-862: Missing Authorization •
CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 0CVE-2020-27663
https://notcve.org/view.php?id=CVE-2020-27663
In GLPI before 9.5.3, ajax/getDropdownValue.php has an Insecure Direct Object Reference (IDOR) vulnerability that allows an attacker to read data from any itemType (e.g., Ticket, Users, etc.). En GLPI versiones anteriores a 9.5.3, el archivo ajax/getDropdownValue.php presenta una vulnerabilidad de Referencia Directa a Objetos No Segura (IDOR) que permite a un atacante leer datos de cualquier itemType (por ejemplo, Ticket, Users, etc.) • https://github.com/glpi-project/glpi/security/advisories/GHSA-pqfv-4pvr-55r4 • CWE-639: Authorization Bypass Through User-Controlled Key •