PT-2019-12839 · Stdonato+1 · Stdonato Dashboard Plugin+1

Published 2019-06-02 · Updated 2020-08-24 · CVE-2019-12530

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions GLPI stdonato Dashboard plugin versions through 0.9.7

Description Incorrect access control was discovered in the stdonato Dashboard plugin for GLPI, affecting several PHP files in the front/sh directory, including df.php, issue.php, load.php, mem.php, traf.php, and uptime.php.

Recommendations For versions through 0.9.7, consider restricting access to the affected PHP files until a patch is available. As a temporary workaround, limit access to the front/sh directory to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2019-12530

Affected Products

Glpi

Stdonato Dashboard Plugin

References · 3

• https://github.com/stdonato/glpi-dashboard/commit/3a89f0085a221d7ad76d1104df6df6c634bd7f14 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2019-12530 · Security Note
• https://osv.dev/vulnerability/CVE-2019-12530 · Vendor Advisory