Attachment 214149 Details for Bug 244971 – Updated vuln.xml with 2 entries related to GLPI

[patch] Updated vuln.xml with 2 entries related to GLPI

vuln.diff (text/plain), 2.62 KB, created by Mathias Monnerville on 2020-05-05 09:37:46 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Mathias Monnerville

Created: 2020-05-05 09:37:46 UTC

Size: 2.62 KB

patch

obsolete

>--- vuln.xml.orig	2020-05-05 13:16:20.441140000 +0200
>+++ vuln.xml	2020-05-05 13:25:38.189038000 +0200
>@@ -58,6 +58,61 @@
> * Do not forget port variants (linux-f10-libxml2, libxml2, etc.)
> -->
> <vuxml xmlns="http://www.vuxml.org/apps/vuxml-1">
>+ <vuln vid="1315bf94-8ec2-11ea-bf23-080027951bbc">
>+ <topic>glpi -- stored XSS</topic>
>+ <affects>
>+ <package>
>+	<name>glpi</name>
>+	<range><lt>9.4.3</lt></range>
>+ </package>
>+ </affects>
>+ <description>
>+ <body xmlns="http://www.w3.org/1999/xhtml">
>+	The MITRE Corporation reports:
>+ <blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13239">
>+ inc/user.class.php in GLPI before 9.4.3 allows XSS via a user picture.
>+	</blockquote>
>+ </body>
>+ </description>
>+ <references>
>+ <url>https://github.com/glpi-project/glpi/commit/c2aa7a7cd6af28be3809acc7e7842d2d2008c0fb</url>
>+ <url>https://www.synacktiv.com/ressources/advisories/GLPI_9.4.0_stored_XSS.pdf</url>
>+ <url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13239</url>
>+ <cvename>CVE-2019-13239</cvename>
>+ </references>
>+ <dates>
>+ <discovery>2019-02-25</discovery>
>+ <entry>2019-07-04</entry>
>+ </dates>
>+ </vuln>
>+
>+ <vuln vid="c26eaf99-8eb1-11ea-bf23-080027951bbc">
>+ <topic>glpi -- account takeover</topic>
>+ <affects>
>+ <package>
>+	<name>glpi</name>
>+	<range><lt>9.4.3</lt></range>
>+ </package>
>+ </affects>
>+ <description>
>+ <body xmlns="http://www.w3.org/1999/xhtml">
>+	The MITRE Corporation reports:
>+	<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-14666">
>+	 GLPI through 9.4.3 is prone to account takeover by abusing the ajax/autocompletion.php autocompletion feature. The lack of correct validation leads to recovery of the token generated via the password reset functionality, and thus an authenticated attacker can set an arbitrary password for any user. This vulnerability can be exploited to take control of admin account. This vulnerability could be also abused to obtain other sensitive fields like API keys or password hashes.
>+	</blockquote>
>+ </body>
>+ </description>
>+ <references>
>+ <url>https://github.com/glpi-project/glpi/security/advisories/GHSA-47hq-pfrr-jh5q</url>
>+ <url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-14666</url>
>+ <cvename>CVE-2019-14666</cvename>
>+ </references>
>+ <dates>
>+ <discovery>2019-08-05</discovery>
>+ <entry>2019-08-05</entry>
>+ </dates>
>+ </vuln>
>+
> <vuln vid="cd864f1a-8e5a-11ea-b5b4-641c67a117d8">
> <topic>cacti -- XSS exposure</topic>
> <affects>

Flags:

mathias: maintainer-approval+

Actions: View | Diff

Attachments on bug 244971: 212608 | 212609 | 214149