PT-2011-4042 · Indeg · Glpi
Vincent Danen
·
Published
2011-08-05
·
Updated
2012-02-16
·
CVE-2011-2720
CVSS v2.0
5.0
Medium
| Vector | AV:N/AC:L/Au:N/C:P/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
GLPI versions prior to 0.80.2
Description
The autocompletion functionality in GLPI does not properly restrict access to certain
username and password fields. This allows remote attackers to obtain sensitive information by sending a crafted POST request.Recommendations
For versions prior to 0.80.2, update to version 0.80.2 or later to resolve the issue. As a temporary workaround, consider disabling the autocompletion functionality until a patch is available. Restrict access to sensitive fields, such as
username and password, to minimize the risk of exploitation.Fix
Information Disclosure
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Glpi