PT-2020-12503 · Glpi+1 · Glpi+1

Trasher · Published 2020-05-05 · Updated 2021-10-26 · CVE-2020-11035

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions GLPI versions 0.83.3 through 9.4.5

Description The issue concerns the generation of CSRF tokens using an insecure algorithm, which utilizes rand, uniqid, and MD5. This does not provide secure values. The problem is fixed in version 9.4.6.

Recommendations For GLPI versions 0.83.3 through 9.4.5, update to version 9.4.6 to resolve the issue.

Fix

Use of a Broken Cryptographic Algorithm

Weakness Enumeration

CWE-327

Related Identifiers

ALT-PU-2020-2358

ALT-PU-2020-2455

CVE-2020-11035

GHSA-W7Q8-58QP-VMPF

MGASA-2020-0220

Affected Products

Alt Linux

Glpi

References · 16

• https://lists.fedoraproject.org/archives/list/[e-mail]/thread/Q4BG2UTINBVV7MTJRXKBQ26GV2UINA6L · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-11035 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-11035 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2020-0220 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2020-11035 · Security Note
• https://advisories.mageia.org/MGASA-2020-0220.html · Security Note
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5WQMONZRWLWOXMHMYWR7A5Q5JJERPMVC · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Q4BG2UTINBVV7MTJRXKBQ26GV2UINA6L · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-11035 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-11035 · Security Note
• https://github.com/glpi-project/glpi/security/advisories/GHSA-gxv6-xq9q-37hg · Note
• https://github.com/glpi-project/glpi/security/advisories/GHSA-rf54-3r4w-4h55 · Note
• https://github.com/glpi-project/glpi/security/advisories/GHSA-w7q8-58qp-vmpf · Note
• https://github.com/glpi-project/glpi/security/advisories/GHSA-3g3h-rwhr-7385 · Note
• https://bugs.mageia.org/show_bug.cgi?id=26625 · Note