SB2012101006 - Multiple vulnerabilities in glpi-project GLPI
Published: October 10, 2012 Updated: September 15, 2021
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 2 secuirty vulnerabilities.
1) Cross-site request forgery (CVE-ID: CVE-2012-4002)
The vulnerability allows a remote attacker to perform cross-site request forgery attacks.
The vulnerability exists due to insufficient validation of the HTTP request origin. A remote attacker can trick the victim to visit a specially crafted web page and perform arbitrary actions on behalf of the victim on the vulnerable website.
2) Cross-site scripting (CVE-ID: CVE-2012-4003)
Vulnerability allows a remote attacker to perform Cross-site scripting attacks.
An input validation error exists in GLPI-PROJECT GLPI before 0.83.3 when processing unknown vectors. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in victim's browser in security context of vulnerable website.
Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.
Remediation
Install update from vendor's website.