CVSS: 5.0EPSS: 0%CPEs: 1EXPL: 1CVE-2020-15226 – SQL Injection in GLPI Search API
https://notcve.org/view.php?id=CVE-2020-15226
In GLPI before version 9.5.2, there is a SQL Injection in the API's search function. Not only is it possible to break the SQL syntax, but it is also possible to utilise a UNION SELECT query to reflect sensitive information such as the current database version, or database user. The most likely scenario for this vulnerability is with someone who has an API account to the system. The issue is patched in version 9.5.2. A proof-of-concept with technical details is available in the linked advisory. • https://github.com/glpi-project/glpi/commit/3dc4475c56b241ad659cc5c7cb5fb65727409cf0 https://github.com/glpi-project/glpi/security/advisories/GHSA-jwpv-7m4h-5gvc • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 8.0EPSS: 0%CPEs: 1EXPL: 0CVE-2020-15177 – Unauthenticated Stored XSS in GLPI
https://notcve.org/view.php?id=CVE-2020-15177
In GLPI before version 9.5.2, the `install/install.php` endpoint insecurely stores user input into the database as `url_base` and `url_base_api`. These settings are referenced throughout the application and allow for vulnerabilities like Cross-Site Scripting and Insecure Redirection Since authentication is not required to perform these changes,anyone could point these fields at malicious websites or form input in a way to trigger XSS. Leveraging JavaScript it's possible to steal cookies, perform actions as the user, etc. The issue is patched in version 9.5.2. En GLPI versiones anteriores a 9.5.2, el endpoint "install/install.php" almacena de forma no segura la entrada del usuario en la base de datos como "url_base" y "url_base_api". • https://github.com/glpi-project/glpi/commit/a8109d4ee970a222faf48cf48fae2d2f06465796 https://github.com/glpi-project/glpi/security/advisories/GHSA-prvh-9m4h-4m79 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.7EPSS: 0%CPEs: 1EXPL: 0CVE-2020-15176 – SQL injection in GLPI
https://notcve.org/view.php?id=CVE-2020-15176
In GLPI before version 9.5.2, when supplying a back tick in input that gets put into a SQL query,the application does not escape or sanitize allowing for SQL Injection to occur. Leveraging this vulnerability an attacker is able to exfiltrate sensitive information like passwords, reset tokens, personal details, and more. The issue is patched in version 9.5.2 En GLPI versiones anteriores a 9.5.2, cuando se suministra un back tick en la entrada que se coloca en una consulta SQL, la aplicación no escapa ni se sanea, permitiendo que ocurra una inyección SQL. Al aprovechar esta vulnerabilidad, un atacante es capaz de exfiltrar información confidencial como contraseñas, tokens de restablecimiento, detalles personales y más. El problema es parcheado en la versión 9.5.2 • https://github.com/glpi-project/glpi/commit/f021f1f365b4acea5066d3e57c6d22658cf32575 https://github.com/glpi-project/glpi/security/advisories/GHSA-x93w-64x9-58qw • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 9.1EPSS: 0%CPEs: 1EXPL: 0CVE-2020-15175 – Unauthenticated File Deletion in GLPI
https://notcve.org/view.php?id=CVE-2020-15175
In GLPI before version 9.5.2, the `pluginimage.send.php` endpoint allows a user to specify an image from a plugin. The parameters can be maliciously crafted to instead delete the .htaccess file for the files directory. Any user becomes able to read all the files and folders contained in “/files/”. Some of the sensitive information that is compromised are the user sessions, logs, and more. An attacker would be able to get the Administrators session token and use that to authenticate. • https://github.com/glpi-project/glpi/commit/6ca9a0e77299a755c356d758344a23278df67f65 https://github.com/glpi-project/glpi/security/advisories/GHSA-rm52-jx9h-rwcp • CWE-552: Files or Directories Accessible to External Parties •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2020-11031 – Insecure encryption algorithm in GLPI
https://notcve.org/view.php?id=CVE-2020-11031
In GLPI before version 9.5.0, the encryption algorithm used is insecure. The security of the data encrypted relies on the password used, if a user sets a weak/predictable password, an attacker could decrypt data. This is fixed in version 9.5.0 by using a more secure encryption library. The library chosen is sodium. En GLPI versiones anteriores a 9.5.0, el algoritmo de cifrado usado no es seguro. • https://github.com/glpi-project/glpi/commit/f1ae6c8481e5c19a6f1801a5548cada45702e01a#diff-b5d0ee8c97c7abd7e3fa29b9a27d1780 https://github.com/glpi-project/glpi/security/advisories/GHSA-7xwm-4vjr-jvqh • CWE-327: Use of a Broken or Risky Cryptographic Algorithm •