PT-2020-14248 · Teclib+1 · Glpi+1

Trasher · Published 2020-10-07 · Updated 2024-05-22 · CVE-2020-15175

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions GLPI versions prior to 9.5.2

Description The issue allows a user to specify an image from a plugin through the "pluginimage.send.php" endpoint. The parameters can be maliciously crafted to delete the .htaccess file for the files directory, enabling any user to read all the files and folders contained in "/files/". This compromises sensitive information, including user sessions and logs. An attacker can obtain the Administrator's session token and use it to authenticate.

Recommendations For versions prior to 9.5.2, update to version 9.5.2 to resolve the issue. As a temporary workaround, consider restricting access to the "pluginimage.send.php" endpoint until the update is applied. Additionally, monitor the "/files/" directory for any unauthorized access or changes.

Exploit

Fix

Files Accessible to External Parties

Weakness Enumeration

CWE-552

Related Identifiers

ALT-PU-2020-3130

ALT-PU-2020-3162

ALT-PU-2024-8094

CVE-2020-15175

GHSA-RM52-JX9H-RWCP

Affected Products

Alt Linux

Glpi

References · 10

• 🔥 https://github.com/Xn2/GLPwn · Exploit
• https://github.com/glpi-project/glpi/commit/6ca9a0e77299a755c356d758344a23278df67f65 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2020-15175 · Security Note
• https://osv.dev/vulnerability/CVE-2020-15175 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2020-15175 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-15175 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-15175 · Vendor Advisory
• https://github.com/glpi-project/glpi/security/advisories/GHSA-rm52-jx9h-rwcp · Note
• https://t.me/cibsecurity/15128 · Telegram Post
• https://t.me/cvenotify/45283 · Telegram Post