PT-2020-18342 · Teclib+1 · Glpi+1

Moderatetrasher · Published 2020-05-12 · Updated 2020-07-27 · CVE-2020-5248

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions GLPI versions prior to 9.4.6

Description The issue involves a default encryption key, GLPIKEY, which is public and used across all instances. This allows unauthorized parties to decrypt sensitive data stored with this key. The key can be changed before installing GLPI, but for existing instances, data must be reencrypted with the new key. However, it's challenging to identify which columns or rows in the database use this key, especially for plugins. Changing the key without updating the data can lead to issues with password sending, but re-storing the data from the UI can resolve this.

Recommendations For versions prior to 9.4.6, update to version 9.4.6 or later to resolve the issue. Additionally, consider reencrypting sensitive data with a new key, and re-store the data from the UI to avoid password sending issues. If possible, change the default encryption key before installing GLPI to prevent this issue.

Exploit

Fix

Using Hardcoded Credentials

Weakness Enumeration

CWE-798

Related Identifiers

ALT-PU-2020-2358

ALT-PU-2020-2455

CVE-2020-5248

GHSA-J222-J9MF-H6J9

Affected Products

Alt Linux

Glpi

References · 9

• 🔥 https://github.com/indevi0us/CVE-2020-5248 · Exploit
• https://github.com/glpi-project/glpi/commit/efd14468c92c4da43333aa9735e65fd20cbc7c6c · Patch
• https://osv.dev/vulnerability/CVE-2020-5248 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-5248 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-5248 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2020-5248 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2020-5248 · Security Note
• https://github.com/glpi-project/glpi/security/advisories/GHSA-j222-j9mf-h6j9 · Note
• https://t.me/cvenotify/3704 · Telegram Post