Vulnerability Details CVE-2021-3486
GLPi 9.5.4 does not sanitize the metadata. This way its possible to insert XSS into plugins to execute JavaScript code.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.014
EPSS Ranking 68.8%
CVSS Severity
CVSS v3 Score 6.1
CVSS v2 Score 4.3
References
- https://bugzilla.redhat.com/show_bug.cgi?id=1947653
- https://github.com/Kitsun3Sec/exploits/tree/master/cms/GLPI/GLPI-stored-XSS
- https://n3k00n3.github.io/blog/09042021/glpi_xss.html
- https://bugzilla.redhat.com/show_bug.cgi?id=1947653
- https://github.com/Kitsun3Sec/exploits/tree/master/cms/GLPI/GLPI-stored-XSS
- https://n3k00n3.github.io/blog/09042021/glpi_xss.html
Products affected by CVE-2021-3486
-
cpe:2.3:a:glpi-project:glpi:9.5.4