Risk | Medium |
Patch available | YES |
Number of vulnerabilities | 1 |
CVE-ID | CVE-2011-2720 |
CWE-ID | CWE-200 |
Exploitation vector | Network |
Public exploit | N/A |
Vulnerable software Subscribe |
GLPI Web applications / CRM systems |
Vendor | glpi-project |
Security Bulletin
This security bulletin contains one medium risk vulnerability.
EUVDB-ID: #VU44829
Risk: Medium
CVSSv3.1: 4.6 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C]
CVE-ID: CVE-2011-2720
CWE-ID:
CWE-200 - Information exposure
Exploit availability: No
DescriptionThe vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.
The autocompletion functionality in GLPI before 0.80.2 does not blacklist certain username and password fields, which allows remote attackers to obtain sensitive information via a crafted POST request.
MitigationInstall update from vendor's website.
Vulnerable software versionsGLPI: 0.42 - 0.80
External linkshttp://lists.fedoraproject.org/pipermail/package-announce/2011-August/063408.html
http://lists.fedoraproject.org/pipermail/package-announce/2011-August/063679.html
http://secunia.com/advisories/45366
http://secunia.com/advisories/45542
http://www.glpi-project.org/spip.php?page=annonce&id_breve=237&lang=en
http://www.mandriva.com/security/advisories?name=MDVSA-2012:014
http://www.openwall.com/lists/oss-security/2011/07/25/7
http://www.openwall.com/lists/oss-security/2011/07/26/11
http://www.securityfocus.com/bid/48884
http://bugzilla.redhat.com/show_bug.cgi?id=726185
http://forge.indepnet.net/issues/3017
http://forge.indepnet.net/projects/glpi/repository/revisions/14951
http://forge.indepnet.net/projects/glpi/repository/revisions/14952
http://forge.indepnet.net/projects/glpi/repository/revisions/14954
http://forge.indepnet.net/projects/glpi/repository/revisions/14955
http://forge.indepnet.net/projects/glpi/repository/revisions/14956
http://forge.indepnet.net/projects/glpi/repository/revisions/14957
http://forge.indepnet.net/projects/glpi/repository/revisions/14958
http://forge.indepnet.net/projects/glpi/repository/revisions/14960
http://forge.indepnet.net/projects/glpi/repository/revisions/14966
http://forge.indepnet.net/projects/glpi/versions/605
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.