CVSS: 7.6EPSS: 0%CPEs: 1EXPL: 0CVE-2020-11032 – SQL injection on addme_observer and addme_assign in GLPI
https://notcve.org/view.php?id=CVE-2020-11032
In GLPI before version 9.4.6, there is a SQL injection vulnerability for all helpdesk instances. Exploiting this vulnerability requires a technician account. This is fixed in version 9.4.6. En GLPI versiones anteriores a 9.4.6, se presenta una vulnerabilidad de inyección SQL para todas las instancias del helpdesk. Una explotación de esta vulnerabilidad requiere una cuenta de técnico. • https://github.com/glpi-project/glpi/security/advisories/GHSA-344w-34h9-wwhh • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 1CVE-2019-14666
https://notcve.org/view.php?id=CVE-2019-14666
GLPI through 9.4.3 is prone to account takeover by abusing the ajax/autocompletion.php autocompletion feature. The lack of correct validation leads to recovery of the token generated via the password reset functionality, and thus an authenticated attacker can set an arbitrary password for any user. This vulnerability can be exploited to take control of admin account. This vulnerability could be also abused to obtain other sensitive fields like API keys or password hashes. GLPI versiones hasta 9.4.3, es propenso a la toma de control de cuentas mediante el abuso de la funcionalidad autocompletion del archivo ajax/autocompletion.php. • https://github.com/glpi-project/glpi/security/advisories/GHSA-47hq-pfrr-jh5q https://www.tarlogic.com/advisories/Tarlogic-2019-GPLI-Account-Takeover.txt • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 1CVE-2019-1010307
https://notcve.org/view.php?id=CVE-2019-1010307
GLPI GLPI Product 9.3.1 is affected by: Cross Site Scripting (XSS). The impact is: All dropdown values are vulnerable to XSS leading to privilege escalation and executing js on admin. The component is: /glpi/ajax/getDropDownValue.php. The attack vector is: 1- User Create a ticket , 2- Admin opens another ticket and click on the "Link Tickets" feature, 3- a request to the endpoint fetches js and executes it. El producto GLPI versión 9.3.1 de GLPI, está afectado por: Cross Site Scripting (XSS). • https://github.com/glpi-project/glpi/blob/9.4/bugfixes/ajax/getDropdownValue.php https://github.com/glpi-project/glpi/releases/tag/9.3.1 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 3.5EPSS: 0%CPEs: 1EXPL: 0CVE-2019-1010310
https://notcve.org/view.php?id=CVE-2019-1010310
GLPI GLPI Product 9.3.1 is affected by: Frame and Form tags Injection allowing admins to phish users by putting code in reminder description. The impact is: Admins can phish any user or group of users for credentials / credit cards. The component is: Tools > Reminder > Description .. Set the description to any iframe/form tags and apply. The attack vector is: The attacker puts a login form, the user fills it and clicks on submit .. the request is sent to the attacker domain saving the data. • https://github.com/glpi-project/glpi/pull/5519 https://github.com/glpi-project/glpi/releases/tag/9.3.1 • CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') •
CVSS: 5.9EPSS: 0%CPEs: 1EXPL: 1CVE-2019-13240
https://notcve.org/view.php?id=CVE-2019-13240
An issue was discovered in GLPI before 9.4.1. After a successful password reset by a user, it is possible to change that user's password again during the next 24 hours without any information except the associated email address. Se detectó un problema en GLPI versiones anteriores a 9.4.1. Después de que un usuario haya restablecido con éxito la contraseña, es posible cambiarla de nuevo durante las próximas 24 horas sin ninguna información, excepto la dirección de correo electrónico asociada. • https://github.com/glpi-project/glpi/commit/5da9f99b2d81713b1e36016b47ce656a33648bc7 https://github.com/glpi-project/glpi/commit/86a43ae47b3dd844947f40a2ffcf1a36e53dbba6 https://github.com/glpi-project/glpi/compare/1783b78...8e621f6 https://github.com/glpi-project/glpi/releases/tag/9.4.1 https://www.synacktiv.com/ressources/advisories/GLPI_9.4.0_unsafe_reset.pdf • CWE-640: Weak Password Recovery Mechanism for Forgotten Password •