CVSS: 7.2EPSS: 2%CPEs: 1EXPL: 2CVE-2020-5248 – Public GLPIKEY can be used to decrypt any data in GLPI
https://notcve.org/view.php?id=CVE-2020-5248
12 May 2020 — GLPI before before version 9.4.6 has a vulnerability involving a default encryption key. GLPIKEY is public and is used on every instance. This means anyone can decrypt sensitive data stored using this key. It is possible to change the key before installing GLPI. But on existing instances, data must be reencrypted with the new key. • https://github.com/indevi0us/CVE-2020-5248 • CWE-798: Use of Hard-coded Credentials •
CVSS: 7.6EPSS: 0%CPEs: 1EXPL: 1CVE-2020-11036 – XSS in GLPI
https://notcve.org/view.php?id=CVE-2020-11036
05 May 2020 — In GLPI before version 9.4.6 there are multiple related stored XSS vulnerabilities. The package is vulnerable to Stored XSS in the comments of items in the Knowledge base. Adding a comment with content "<script>alert(1)</script>" reproduces the attack. This can be exploited by a user with administrator privileges in the User-Agent field. It can also be exploited by an outside party through the following steps: 1. • https://github.com/glpi-project/glpi/security/advisories/GHSA-3g3h-rwhr-7385 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 28%CPEs: 1EXPL: 0CVE-2020-11034 – bypass of manageRedirect in GLPI
https://notcve.org/view.php?id=CVE-2020-11034
05 May 2020 — In GLPI before version 9.4.6, there is a vulnerability that allows bypassing the open redirect protection based which is based on a regexp. This is fixed in version 9.4.6. En GLPI versiones anteriores a 9.4.6, se presenta una vulnerabilidad que permite omitir la protección de redireccionamiento abierto el cual es basada en un regexp. Esto es corregido en la versión 9.4.6. • https://github.com/glpi-project/glpi/security/advisories/GHSA-gxv6-xq9q-37hg • CWE-185: Incorrect Regular Expression CWE-601: URL Redirection to Untrusted Site ('Open Redirect') •
CVSS: 8.8EPSS: 3%CPEs: 1EXPL: 1CVE-2019-14666
https://notcve.org/view.php?id=CVE-2019-14666
25 Sep 2019 — GLPI through 9.4.3 is prone to account takeover by abusing the ajax/autocompletion.php autocompletion feature. The lack of correct validation leads to recovery of the token generated via the password reset functionality, and thus an authenticated attacker can set an arbitrary password for any user. This vulnerability can be exploited to take control of admin account. This vulnerability could be also abused to obtain other sensitive fields like API keys or password hashes. GLPI versiones hasta 9.4.3, es prop... • https://github.com/glpi-project/glpi/security/advisories/GHSA-47hq-pfrr-jh5q • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 5.9EPSS: 0%CPEs: 1EXPL: 1CVE-2019-13240
https://notcve.org/view.php?id=CVE-2019-13240
10 Jul 2019 — An issue was discovered in GLPI before 9.4.1. After a successful password reset by a user, it is possible to change that user's password again during the next 24 hours without any information except the associated email address. Se detectó un problema en GLPI versiones anteriores a 9.4.1. Después de que un usuario haya restablecido con éxito la contraseña, es posible cambiarla de nuevo durante las próximas 24 horas sin ninguna información, excepto la dirección de correo electrónico asociada. • https://github.com/glpi-project/glpi/commit/5da9f99b2d81713b1e36016b47ce656a33648bc7 • CWE-640: Weak Password Recovery Mechanism for Forgotten Password •
CVSS: 8.1EPSS: 0%CPEs: 1EXPL: 0CVE-2019-10233
https://notcve.org/view.php?id=CVE-2019-10233
27 Mar 2019 — Teclib GLPI before 9.4.1.1 is affected by a timing attack associated with a cookie. Teclib GLPI, en versiones anteriores a la 9.4.1.1, se ha visto afectado por un ataque de sincronización asociado a una cookie. • https://github.com/glpi-project/glpi/pull/5562 • CWE-203: Observable Discrepancy •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2018-7562
https://notcve.org/view.php?id=CVE-2018-7562
12 Mar 2018 — A remote code execution issue was discovered in GLPI through 9.2.1. There is a race condition that allows temporary access to an uploaded executable file that will be disallowed. The application allows an authenticated user to upload a file when he/she creates a new ticket via front/fileupload.php. This feature is protected using different types of security features like the check on the file's extension. However, the application uploads and creates a file, though this file is not allowed, and then deletes ... • https://github.com/glpi-project/glpi/pull/3650 • CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') CWE-434: Unrestricted Upload of File with Dangerous Type •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2018-7563
https://notcve.org/view.php?id=CVE-2018-7563
12 Mar 2018 — An issue was discovered in GLPI through 9.2.1. The application is affected by XSS in the query string to front/preference.php. An attacker is able to create a malicious URL that, if opened by an authenticated user with debug privilege, will execute JavaScript code supplied by the attacker. The attacker-supplied code can perform a wide variety of actions, such as stealing the victim's session token or login credentials, performing arbitrary actions on the victim's behalf, and logging their keystrokes. Se ha ... • https://github.com/glpi-project/glpi/pull/3647 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 0CVE-2017-11183
https://notcve.org/view.php?id=CVE-2017-11183
28 Jul 2017 — front/backup.php in GLPI before 9.1.5 allows remote authenticated administrators to delete arbitrary files via a crafted file parameter. El archivo front/backup.php en GLPI anterior a la versión 9.1.5, permite a los administradores autenticados remotos eliminar archivos arbitrarios por medio de un parámetro file creado. • https://github.com/glpi-project/glpi/issues/2450 • CWE-20: Improper Input Validation •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2017-11184
https://notcve.org/view.php?id=CVE-2017-11184
28 Jul 2017 — SQL injection exists in front/devicesoundcard.php in GLPI before 9.1.5 via the start parameter. Se presenta una inyección SQL en el archivo front/devicesoundcard.php en GLPI anterior a la versión 9.1.5, por medio del parámetro start. • https://github.com/glpi-project/glpi/issues/2449 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •