PT-2011-4042 · Indeg · Glpi

Vincent Danen

·

Publicado

2011-08-05

·

Atualizado

2012-02-16

·

CVE-2011-2720

CVSS v2.0

5.0

Média

VetorAV:N/AC:L/Au:N/C:P/I:N/A:N
Name of the Vulnerable Software and Affected Versions GLPI versions prior to 0.80.2
Description The autocompletion functionality in GLPI does not properly restrict access to certain username and password fields. This allows remote attackers to obtain sensitive information by sending a crafted POST request.
Recommendations For versions prior to 0.80.2, update to version 0.80.2 or later to resolve the issue. As a temporary workaround, consider disabling the autocompletion functionality until a patch is available. Restrict access to sensitive fields, such as username and password, to minimize the risk of exploitation.

Correção

Information Disclosure

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2011-2720

Produtos afetados

Glpi