CVE-2024-27104

GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. A user with rights to create and share dashboards can build a dashboard containing javascript code. Any user that will open this dashboard will be subject to an XSS attack. This issue has been patched in version 10.0.13.

CVSS v3 4.5 MEDIUM

4.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 0.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/glpi-project/glpi/commit/b409ca437864607b03c2014b9e3293b7f141af65	Patch
https://github.com/glpi-project/glpi/releases/tag/10.0.13	Release Notes
https://github.com/glpi-project/glpi/security/advisories/GHSA-prc3-cx5m-h5mj	Vendor Advisory
https://github.com/glpi-project/glpi/commit/b409ca437864607b03c2014b9e3293b7f141af65	Patch
https://github.com/glpi-project/glpi/releases/tag/10.0.13	Release Notes
https://github.com/glpi-project/glpi/security/advisories/GHSA-prc3-cx5m-h5mj	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:glpi-project:glpi:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2024-03-18 17:15

Updated : 2025-01-02 15:47

NVD link : CVE-2024-27104

Mitre link : CVE-2024-27104

CVE.ORG link : CVE-2024-27104

JSON object : View

Products Affected

glpi-project

glpi

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2024-27104", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "[email protected]", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 0.9}, {"type": "Primary", "source": "[email protected]", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 4.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 1.7}]}, "published": "2024-03-18T17:15:06.890", "references": [{"url": "https://github.com/glpi-project/glpi/commit/b409ca437864607b03c2014b9e3293b7f141af65", "tags": ["Patch"], "source": "[email protected]"}, {"url": "https://github.com/glpi-project/glpi/releases/tag/10.0.13", "tags": ["Release Notes"], "source": "[email protected]"}, {"url": "https://github.com/glpi-project/glpi/security/advisories/GHSA-prc3-cx5m-h5mj", "tags": ["Vendor Advisory"], "source": "[email protected]"}, {"url": "https://github.com/glpi-project/glpi/commit/b409ca437864607b03c2014b9e3293b7f141af65", "tags": ["Patch"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://github.com/glpi-project/glpi/releases/tag/10.0.13", "tags": ["Release Notes"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://github.com/glpi-project/glpi/security/advisories/GHSA-prc3-cx5m-h5mj", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "[email protected]", "description": [{"lang": "en", "value": "CWE-79"}]}, {"type": "Primary", "source": "[email protected]", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. A user with rights to create and share dashboards can build a dashboard containing javascript code. Any user that will open this dashboard will be subject to an XSS attack. This issue has been patched in version 10.0.13.\n"}, {"lang": "es", "value": "GLPI es un paquete gratuito de software de gesti\u00f3n de TI y activos, gesti\u00f3n de centros de datos, ITIL Service Desk, seguimiento de licencias y auditor\u00eda de software. Un usuario con derechos para crear y compartir paneles puede crear un panel que contenga c\u00f3digo javascript. Cualquier usuario que abra este panel estar\u00e1 sujeto a un ataque XSS. Este problema se solucion\u00f3 en la versi\u00f3n 10.0.13."}], "lastModified": "2025-01-02T15:47:16.617", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:glpi-project:glpi:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9C74E461-8C32-4A60-BDEF-57969DABC409", "versionEndExcluding": "10.0.13", "versionStartIncluding": "9.5.0"}], "operator": "OR"}]}], "sourceIdentifier": "[email protected]"}