SB2020051277 - Multiple vulnerabilities in glpi-project GLPI

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2020051277

SB2020051277 - Multiple vulnerabilities in glpi-project GLPI

Published: May 12, 2020 Updated: November 14, 2025

Security Bulletin ID SB2020051277
Severity
Medium
Patch available
YES
Number of vulnerabilities 3
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

Medium 67% Low 33%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 3 secuirty vulnerabilities.


1) Cross-site request forgery (CVE-ID: CVE-2020-11060)

The vulnerability allows a remote attacker to perform cross-site request forgery attacks.

The vulnerability exists due to insufficient validation of the HTTP request origin. A remote attacker can trick the victim to visit a specially crafted web page and perform arbitrary actions on behalf of the victim on the vulnerable website, such as execute system commands by abusing the backup functionality. Theoretically, this vulnerability can be exploited by an attacker without a valid account by using a CSRF. Due to the difficulty of the exploitation, the attack is only conceivable by an account having Maintenance privileges and the right to add WIFI networks. This is fixed in version 9.4.6.


2) Cross-site scripting (CVE-ID: CVE-2020-11062)

The vulnerability allows a remote authenticated user to read and manipulate data.

In GLPI after 0.68.1 and before 9.4.6, multiple reflexive XSS occur in Dropdown endpoints due to an invalid Content-Type. This has been fixed in version 9.4.6.


3) Use of hard-coded credentials (CVE-ID: CVE-2020-5248)

The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.

GLPI before before version 9.4.6 has a vulnerability involving a default encryption key. GLPIKEY is public and is used on every instance. This means anyone can decrypt sensitive data stored using this key. It is possible to change the key before installing GLPI. But on existing instances, data must be reencrypted with the new key. Problem is we can not know which columns or rows in the database are using that; espcially from plugins. Changing the key without updating data would lend in bad password sent from glpi; but storing them again from the UI will work.


Remediation

Install update from vendor's website.

References