ALT-PU-2024-2654-1
Package glpi updated to version 10.0.12-alt1 for branch sisyphus_e2k.
Closed vulnerabilities
Published: 2024-02-01
Modified: 2024-11-21
Modified: 2024-11-21
CVE-2023-51446
GLPI is a Free Asset and IT Management Software package. When authentication is made against a LDAP, the authentication form can be used to perform LDAP injection. Upgrade to 10.0.12.
Severity: HIGH (8.1)
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
References:
- https://github.com/glpi-project/glpi/commit/58c67d78f2e3ad08264213e9aaf56eab3c9ded35
- https://github.com/glpi-project/glpi/commit/58c67d78f2e3ad08264213e9aaf56eab3c9ded35
- https://github.com/glpi-project/glpi/releases/tag/10.0.12
- https://github.com/glpi-project/glpi/releases/tag/10.0.12
- https://github.com/glpi-project/glpi/security/advisories/GHSA-p995-jmfv-c7r8
- https://github.com/glpi-project/glpi/security/advisories/GHSA-p995-jmfv-c7r8
Published: 2024-02-01
Modified: 2024-11-21
Modified: 2024-11-21
CVE-2024-23645
GLPI is a Free Asset and IT Management Software package. A malicious URL can be used to execute XSS on reports pages. Upgrade to 10.0.12.
Severity: MEDIUM (6.1)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
References:
- https://github.com/glpi-project/glpi/commit/6cf265936c4f6edf7dea7c78b12e46d75b94d9b0
- https://github.com/glpi-project/glpi/commit/6cf265936c4f6edf7dea7c78b12e46d75b94d9b0
- https://github.com/glpi-project/glpi/commit/fc1f6da9d158933b870ff374ed3a50ae98dcef4a
- https://github.com/glpi-project/glpi/commit/fc1f6da9d158933b870ff374ed3a50ae98dcef4a
- https://github.com/glpi-project/glpi/releases/tag/10.0.12
- https://github.com/glpi-project/glpi/releases/tag/10.0.12
- https://github.com/glpi-project/glpi/security/advisories/GHSA-2gj5-qpff-ff3x
- https://github.com/glpi-project/glpi/security/advisories/GHSA-2gj5-qpff-ff3x