PT-2019-12839 · Stdonato+1 · Stdonato Dashboard Plugin+1

Publicado 2019-06-02 · Atualizado 2020-08-24 · CVE-2019-12530

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions GLPI stdonato Dashboard plugin versions through 0.9.7

Description Incorrect access control was discovered in the stdonato Dashboard plugin for GLPI, affecting several PHP files in the front/sh directory, including df.php, issue.php, load.php, mem.php, traf.php, and uptime.php.

Recommendations For versions through 0.9.7, consider restricting access to the affected PHP files until a patch is available. As a temporary workaround, limit access to the front/sh directory to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

Correção

Improper Authentication

Enumeração de Fraquezas

CWE-287

Identificadores relacionados

CVE-2019-12530

Produtos afetados

Glpi

Stdonato Dashboard Plugin

Referências · 3

• https://github.com/stdonato/glpi-dashboard/commit/3a89f0085a221d7ad76d1104df6df6c634bd7f14 · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2019-12530 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2019-12530 · Aviso do Fabricante