PT-2021-14411 · Glpi+1 · Glpi+1

Trasher · Published 2021-03-03 · Updated 2024-05-22 · CVE-2021-21313

Positive Technologies (AI Summary)

CVSS v3.1

4.9

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions GLPI versions prior to 9.5.4

Description The issue concerns a vulnerability in the "/ajax/common.tabs.php" endpoint, where at least two parameters, target and id, are not properly sanitized. This can be exploited using specific payloads, depending on which parameter is targeted. For example, the endpoint can be exploited by manipulating the target and id parameters to execute malicious code, such as alerting the document cookie.

Recommendations For versions prior to 9.5.4, update to version 9.5.4 or later to resolve the issue. As a temporary workaround, consider restricting access to the "/ajax/common.tabs.php" endpoint until a patch is applied. Avoid using the parameters target and id in the affected API endpoint until the issue is resolved.

Fix

Special Elements Injection

XSS

Weakness Enumeration

CWE-74

CWE-79

Related Identifiers

ALT-PU-2021-1583

ALT-PU-2021-1660

ALT-PU-2024-8094

CVE-2021-21313

GHSA-H4HJ-MRPG-XFGX

Affected Products

Alt Linux

Glpi

References · 9

• https://osv.dev/vulnerability/UBUNTU-CVE-2021-21313 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-21313 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-21313 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-21313 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-21313 · Security Note
• https://github.com/glpi-project/glpi/security/advisories/GHSA-h4hj-mrpg-xfgx · Note
• https://github.com/glpi-project/glpi/releases/tag/9.5.4 · Note
• https://t.me/cibsecurity/24427 · Telegram Post
• https://t.me/cvenotify/11115 · Telegram Post