CVE-2020-15217 — Cross-site Scripting in Glpi

CWE-79 — Cross-site Scripting4 documents2 sources
Severity
5.3MEDIUMNVD
EPSS
0.2%
top 53.72%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Glpi-project Glpi
Timeline
PublishedOct 7
Latest updateOct 8

Description

In GLPI before version 9.5.2, there is a leakage of user information through the public FAQ. The issue was introduced in version 9.5.0 and patched in 9.5.2. As a workaround, disable public access to the FAQ.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:NExploitability: 3.9 | Impact: 1.4

Affected Packages2 packages

▶NVDglpi-project/glpi9.5.0 — 9.5.2
▶CVEListV5glpi-project/glpi>= 9.5.0, < 9.5.2

Patches

Patch: github.com ↗Patch: github.com ↗

💬Community

3
Bugzilla
CVE-2020-15217 glpi: information disclosure through public FAQ [epel-7]↗2020-10-08
▶
Bugzilla
CVE-2020-15217 glpi: information disclosure through public FAQ [fedora-all]↗2020-10-08
▶
Bugzilla
CVE-2020-15217 glpi: information disclosure through public FAQ↗2020-10-08
▶