SB2024110637 - Multiple vulnerabilities in GLPI

Main Vulnerability Database SB2024110637

SB2024110637 - Multiple vulnerabilities in GLPI

Published: November 6, 2024 Updated: December 11, 2024

Security Bulletin ID SB2024110637

Severity

High

Patch available

YES

Number of vulnerabilities 16

Exploitation vector Remote access

Highest impact Code execution

Breakdown by Severity

Low
Medium
High
Critical

Description

This security bulletin contains information about 16 secuirty vulnerabilities.

1) Stored cross-site scripting (CVE-ID: CVE-2024-45611)

The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data in RSS feeds. A remote user can inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

2) Reflected cross-site scripting (CVE-ID: CVE-2024-41678)

The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

3) Reflected cross-site scripting (CVE-ID: CVE-2024-45610)

The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

4) Reflected cross-site scripting (CVE-ID: CVE-2024-45609)

The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

5) Reflected cross-site scripting (CVE-ID: CVE-2024-43418)

The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

6) Reflected cross-site scripting (CVE-ID: CVE-2024-43417)

The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

7) Stored cross-site scripting (CVE-ID: CVE-2024-47759)

The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data via document upload. A remote user can upload a specially crafted document and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

8) SQL injection (CVE-ID: CVE-2024-41679)

The vulnerability allows a remote user to execute arbitrary SQL queries in database.

The vulnerability exists due to insufficient sanitization of user-supplied data in ticket form. A remote user can send a specially crafted request to the affected application and execute arbitrary SQL commands within the application database.

Successful exploitation of this vulnerability may allow a remote attacker to read, delete, modify data in database and gain complete control over the affected application.

9) Session Fixation (CVE-ID: CVE-2024-50339)

The vulnerability allows a remote attacker to compromise arbitrary user account.

The vulnerability exists due to a session fixation error. A remote non-authenticated attacker can hijack sessions of an arbitrary user and gain unauthorized access to the application.

10) SQL injection (CVE-ID: CVE-2024-45608)

The vulnerability allows a remote user to execute arbitrary SQL queries in database.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote user can send a specially crafted request to the affected application and execute arbitrary SQL commands within the application database.

11) Improper access control (CVE-ID: CVE-2024-48912)

The vulnerability allows a remote user to delete arbitrary accounts within the application.

The vulnerability exists due to improper access restrictions. A remote user can bypass implemented security restrictions and delete an arbitrary user accounts within the application.

12) Improper access control (CVE-ID: CVE-2024-47760)

The vulnerability allows a remote user to gain unauthorized access to otherwise restricted functionality.

The vulnerability exists due to improper access restrictions within the API. A remote user can bypass implemented security restrictions and take over an arbitrary user account.

13) Weak Password Recovery Mechanism for Forgotten Password (CVE-ID: CVE-2024-47761)

The vulnerability allows a remote user to escalate privileges within the application.

The vulnerability exists due to incorrect implementation of the password reset feature. A remote privileged user with access to the sent notifications contents can take control of an account with higher privileges.

14) Improper access control (CVE-ID: CVE-2024-47758)

The vulnerability allows a remote user to gain unauthorized access to otherwise restricted functionality.

The vulnerability exists due to improper access restrictions within the API. A remote user can bypass implemented security restrictions and take over an arbitrary user account.

15) Information disclosure (CVE-ID: CVE-2024-43416)

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to excessive data output by the application. A remote attacker can enumerate email addresses of registered users.

16) SQL injection (CVE-ID: CVE-2024-40638)

The vulnerability allows a remote attacker to execute arbitrary SQL queries in database.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote attacker can send a specially crafted request to the affected application and execute arbitrary SQL commands within the application database.

Successful exploitation of this vulnerability may allow a remote attacker to read, delete, modify data in database and gain complete control over the affected application.

Remediation

Install update from vendor's website.

References