PT-2020-14288 · Teclib+1 · Glpi+1

Moderatetrasher · Published 2020-10-07 · Updated 2024-05-22 · CVE-2020-15217

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions GLPI versions 9.5.0 through 9.5.1

Description The issue concerns a leakage of user information through the public FAQ. It was introduced in version 9.5.0 and patched in 9.5.2.

Recommendations For GLPI versions 9.5.0 through 9.5.1, as a workaround, disable public access to the FAQ. Update to version 9.5.2 to resolve the issue.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

ALT-PU-2020-3130

ALT-PU-2020-3162

ALT-PU-2024-8094

CVE-2020-15217

GHSA-X9HG-J29F-WVVV

Affected Products

Alt Linux

Glpi

References · 5

• https://github.com/glpi-project/glpi/commit/39e25591efddc560e3679ab07e443ee6198705e2 · Patch
• https://osv.dev/vulnerability/CVE-2020-15217 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-15217 · Security Note
• https://github.com/glpi-project/glpi/security/advisories/GHSA-x9hg-j29f-wvvv · Note
• https://t.me/cibsecurity/15127 · Telegram Post