GLPI vulnerabilities

GLPI is a free asset and IT management software package. From version 11.0.0 to 11.0.2 (before 11.0.3), an unauthenticated user can perform a SQL injection through the inventory endpoint. This vulnerability is fixed in version 11.0.3.

GLPI prior to versions 10.0.21 and 11.0.3 allows an unauthorized user to access GLPI documents attached to any item (ticket, asset, etc.). If the public FAQ is enabled, this unauthorized access can be performed by an anonymous user. This vulnerability is fixed in 10.0.21 and 11.0.3.

GLPI before 9.1.5.1 has SQL Injection in the condition rule field, exploitable via front/rulesengine.test.php.

Cross-Site Request Forgery (CSRF) vulnerability in GLPI 0.90.4 allows remote authenticated attackers to submit a request that could lead to the creation of an admin account in the application.

Multiple SQL injection vulnerabilities in GLPI 0.90.4 allow an authenticated remote attacker to execute arbitrary SQL commands by using a certain character when the database is configured to use Big5 encoding.

In GLPI before version 0.85.3, there is an unrestricted file upload vulnerability that allows remote authenticated users to execute arbitrary code by adding a file with an executable extension as an attachment to a new ticket.

Directory traversal vulnerability in inc/autoload.function.php in GLPI before version 0.84.8 allows remote attackers to include and execute arbitrary local files via a .._ (dot dot underscore) in an item type passed to the getItemForItemtype function.

Multiple SQL injection vulnerabilities in GLPI before version 0.83.9 allow remote attackers to execute arbitrary SQL commands through various parameters in the application.

GLPI is a free asset and IT management software package. From 11.0.0 until 11.0.8, a form administrator can use Form import with a crafted illustration or scene identifier that traverses outside the intended custom-asset directory. The imported file can be written to an executable server location, allowing a malicious script to be invoked remotely. This issue is fixed in version 11.0.8.

GLPI before 9.1.5.1 has SQL Injection in the $crit variable in inc/computer_softwareversion.class.php, exploitable via ajax/common.tabs.php.

GLPI versions before 9.1.5 are vulnerable to SQL injection via an ajax/getDropdownValue.php request with an entity_restrict parameter that is not a list of integers.

GLPI through 12.0.0 contains a missing authorization vulnerability in ajax/map.php that allows authenticated low-privileged users to search itemtypes they cannot view by omitting the canView() check. Attackers can submit crafted itemtype and search criteria for types like Contact, Supplier, Contract and Budget to obtain match counts, titles and coordinates within their entities.

GLPI is a free asset and IT management software package. From 0.85 until 10.0.26 and 11.0.8, a low-privileged authenticated user can create, update, or delete knowledge base comments and translations without the required authorization for the affected content. This issue is fixed in versions 11.0.8 and 10.0.26.

GLPI is a free asset and IT management software package. From 11.0.6 until 11.0.8, an authenticated technician can store active markup in supplier website fields. Any user who opens the affected item's suppliers list triggers the stored cross-site scripting payload. This issue is fixed in version 11.0.8.

GLPI is a free asset and IT management software package. From 9.4.0 until 10.0.26 and 11.0.8, an attacker with the READ right on logs can craft a URL for the history tab that injects attacker-controlled values into a database query. This permits SQL injection through the history tab endpoint. This issue is fixed in versions 11.0.8 and 10.0.26.

GLPI is a free asset and IT management software package. From 0.84 until 10.0.26 and 11.0.8, an administrator holding the Update auth and sync or Update auth, sync and 2FA right can change the authentication method and disable two-factor authentication for user accounts outside the administrator's entity scope. The affected user-account administration flow did not consistently enforce the target user's entity-scoped update permission. This issue is fixed in versions 11.0.8 and 10.0.26.

GLPI is a free asset and IT management software package. From 11.0.0 until 11.0.8, a low-privileged authenticated user can use the new API (v2) to perform update operations that the same user is normally forbidden to perform through the user interface. The API update flow does not consistently enforce the applicable authorization checks. This issue is fixed in version 11.0.8.

GLPI is a free asset and IT management software package. From 11.0.5 until 11.0.8, under certain conditions, permission logic can grant access to a document without confirming that the document is linked to the targeted item. A user can use an unrelated item that the user is permitted to view to read a document linked to an inaccessible item. This issue is fixed in version 11.0.8.

In GLPI, a technician can manipulate the authtype value through the API to change another user's authentication method. Under configurations using the legacy REST API interface or SSO logins, this can change a super-administrator's authentication method and enable account takeover. The issue is fixed in versions 11.0.8 and 10.0.26.

In GLPI, an attacker can craft a URL for a dashboard that reflects attacker-controlled markup without sufficient output encoding. A user who opens the crafted URL triggers reflected cross-site scripting in the dashboard. The issue is fixed in version 11.0.8.

In GLPI, the time-based one-time password verification endpoint does not limit failed submissions per user. An attacker who has obtained a user's primary authentication credentials can repeatedly submit TOTP values against the MFA verification flow, making brute-force compromise of the second factor and subsequent account takeover possible. The issue is fixed in version 11.0.8.

GLPI is a free asset and IT management software package. From 0.70 until 10.0.26 and 11.0.8, an authenticated hotliner or technician can submit crafted criteria through the user import feature to bypass the configured default LDAP filter. This allows access to LDAP objects that the default filter was intended to exclude. This issue is fixed in versions 11.0.8 and 10.0.26.

In GLPI, any logged-in user can exploit insufficient path validation in the profile-picture update flow to request deletion of an attacker-selected file hosted by the server. The issue is fixed in versions 11.0.8 and 10.0.26.

GLPI is a free asset and IT management software package. From 0.72 until 10.0.26 and 11.0.8, an authenticated user without the required permission can enable debug mode. The affected user-setting update does not enforce the privilege boundary intended to restrict debug-mode activation. This issue is fixed in versions 11.0.8 and 10.0.26.

A security vulnerability has been detected in GLPI versions 11.0.5, 11.0.6, and 11.0.7 in the Document Handler component. The function Document::canViewFile in front/document.send.php improperly validates the docid argument, leading to authorization bypass. The attack can be executed remotely but is difficult to exploit due to high complexity.

GLPI is a free asset and IT management software package. Starting in version 0.78 and prior to versions 10.0.25 and 11.0.7, an authenticated user with config READ permission can read a specific asset object.

GLPI from version 10.0.4 to 10.0.24 allows a technician to store an XSS payload in the asset locked tab. The payload executes when an administrator views the tab.

GLPI, a free IT asset management software, in versions 0.50 through 10.0.24 and 11.0.6 allows a technician to read arbitrary files inside the GLPI_DOC_DIR. This is fixed in versions 10.0.25 and 11.0.7.

Vulnerability in GLPI (versions 9.5.0 through 10.0.24 and 11.0.6) allows low-privilege users with planning access to delete any object in the system.

In GLPI (IT management software) from version 0.78 to 10.0.24 and 11.0.6, a technician can delete arbitrary files from the filesystem if the webserver has write permissions on them.

GLPI versions 11.0.0 through 11.0.6 allow a technician to store an XSS payload in ITIL costs. This issue has been fixed in version 11.0.7.

An unauthenticated user with write access to the knowledge base can store an XSS payload in a knowledge base item in GLPI before version 11.0.7.

GLPI (free asset and IT management software) versions 11.0.0 through 11.0.6 contain a vulnerability that allows an authenticated user with forms READ permission to export the structure of unauthorized forms.

GLPI is a free asset and IT management software package. Starting in version 9.1.0 and prior to version 10.0.21, an unauthorized user with an API access can read all knowledge base entries. Users should upgrade to 10.0.21 to receive a patch.

GLPI, a free asset and IT management software, versions 10.0.0 through 10.0.20 allow an unauthenticated user to store an XSS payload via the inventory endpoint.

GLPI is a free IT asset management software that has a SQL injection vulnerability in the dashboards administration panel. An administrator can trigger this vulnerability, potentially leading to unauthorized data access.

GLPI is a free asset and IT management software package. Starting in version 9.5.0 and prior to version 10.0.8, an incorrect rights check on a file allows an unauthenticated user to access dashboards data.

GLPI is a free asset and IT management software package. Starting in version 9.5.0 and prior to version 10.0.8, an incorrect rights check on a file accessible by an authenticated user allows a threat actor to interact, modify, or see Dashboard data.

GLPI is a free asset and IT management software package. In versions from 9.4.0 to prior to 10.0.8, a malicious link can be crafted by an unauthenticated user, leading to a reflected XSS vulnerability if any authenticated user opens the crafted link.

GLPI is a free asset and IT management software package. Versions from 9.2.0 to prior to 10.0.8 have an incorrect rights check on a file accessible by an authenticated user, allowing access to view all KnowbaseItems.

GLPI is a free asset and IT management software package. Versions from 0.68 to prior to 10.0.8 have an incorrect rights check on a file accessible by an authenticated user, allowing access to the list of all users and their personal information.