PT-2012-3035 · Glpi · Glpi

Emilien Girault · Publicado 2012-07-12 · Atualizado 2012-07-16 · CVE-2012-1037

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Média

Vetor base

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions GLPI versions 0.78 through 0.80.61

Description The issue allows remote authenticated users to execute arbitrary PHP code via a URL in the sub type parameter in the front/popup.php file.

Recommendations For GLPI versions 0.78 through 0.80.61, update to a version that contains a fix for this issue to prevent remote execution of arbitrary PHP code.

Correção

Code Injection

Enumeração de Fraquezas

CWE-94

Identificadores relacionados

CVE-2012-1037

Produtos afetados

Glpi

Referências · 7

• https://nvd.nist.gov/vuln/detail/CVE-2012-1037 · Nota de Segurança
• https://forge.indepnet.net/projects/glpi/repository/revisions/17457/diff/branches/0.80-bugfixes/front/popup.php · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1037 · Nota
• http://seclists.org/fulldisclosure/2012/Feb/157 · Nota
• http://mandriva.com/security/advisories?name=MDVSA-2012:016 · Aviso do Fabricante
• https://forge.indepnet.net/issues/3338 · Nota
• https://forge.indepnet.net/projects/glpi/versions/685 · Nota