PT-2024-3278 · Glpi+2 · Glpi+2

Cedric-Anne · Published 2022-09-15 · Updated 2025-01-02 · CVE-2024-27104

Positive Technologies (AI Summary)

CVSS v2.0

6.1

Medium

Base vector

AV:N/AC:L/Au:M/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions GLPI versions prior to 10.0.13

Description The issue is related to improper input neutralization during web page creation, allowing a remote attacker to conduct a cross-site scripting (XSS) attack. A user with rights to create and share dashboards can build a dashboard containing javascript code, and any user who opens this dashboard will be subject to an XSS attack.

Recommendations For versions prior to 10.0.13, update to version 10.0.13 to resolve the issue. As a temporary workaround, consider restricting access to dashboard creation and sharing features to minimize the risk of exploitation. Avoid using dashboards that contain javascript code until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

ALT-PU-2022-2614

ALT-PU-2022-2624

ALT-PU-2022-2665

ALT-PU-2023-7633

ALT-PU-2024-4487

ALT-PU-2024-4750

ALT-PU-2024-8030

ALT-PU-2024-8094

BDU:2024-03510

CVE-2024-27104

GHSA-PRC3-CX5M-H5MJ

Affected Products

Alt Linux

Glpi

Red Os

References · 24

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/glpi_htmlawed_php_injection.rb · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/27xxx/CVE-2024-27104.json · Exploit
• 🔥 https://github.com/Orange-Cyberdefense/CVE-repository/blob/master/PoCs/POC_2022-35914.sh · Exploit
• 🔥 https://github.com/Orange-Cyberdefense/CVE-repository · Exploit
• 🔥 https://github.com/cosad3s/CVE-2022-35914-poc · Exploit
• 🔥 https://github.com/cactuschibre/CVE-2022-35914-poc · Exploit
• 🔥 https://github.com/Kitsun3Sec/exploits/tree/master/cms/GLPI/GLPI-stored-XSS · Exploit
• 🔥 https://github.com/Wangyanan131/CVE-2022-31061 · Exploit
• 🔥 https://github.com/Vu0r1-sec/CVE-2022-31061 · Exploit
• https://github.com/glpi-project/glpi/commit/b409ca437864607b03c2014b9e3293b7f141af65 · Patch
• https://github.com/glpi-project/glpi/security/advisories/GHSA-prc3-cx5m-h5mj · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-03510 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-27104 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2024-27104 · Security Note
• http://repo.red-soft.ru/redos/7.3c/x86_64/updates · Vendor Advisory