CVE Vulnerability

CVE-2020-15176

In GLPI before version 9.5.2, when supplying a back tick in input that gets put into a SQL query,the application does not escape or sanitize allowing for SQL Injection to occur. Leveraging this vulnerability an attacker is able to exfiltrate sensitive information like passwords, reset tokens, personal details, and more. The issue is patched in version 9.5.2

5 /10

CVSS v2.0 :

V3 Legend

Vector :

Exploitability : 10 / Impact : 2.9

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

Scope

8.6 /10

CVSS v3.0 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope CHANGED

References
Link Resource
https://github.com/glpi-project/glpi/commit/f021f1f365b4acea5066d3e57c6d22658cf32575 Patch Third Party Advisory
https://github.com/glpi-project/glpi/security/advisories/GHSA-x93w-64x9-58qw Third Party Advisory
Configurations

Configuration 1

cpe:2.3:a:glpi-project:glpi:*:*:*:*:*:*:*:*
Information

Published : 2020-10-07 07:15

Updated : 2020-10-16 03:36

NVD link : CVE-2020-15176

Mitre link : CVE-2020-15176

Products Affected
No products.
CWE
CWE-89