Glpi-Project: >> Glpi >> 9.5.4 Security Vulnerabilities
GLPI is a free Asset and IT management software package. In versions prior to 9.5.6, a user who is logged in to GLPI can bypass Cross-Site Request Forgery (CSRF) protection in many places. This could allow a malicious actor to perform many actions on GLPI. This issue is fixed in version 9.5.6. There are no workarounds aside from upgrading.
CVSS Score
8.8
EPSS Score
0.001
Published
2021-09-15
GLPi 9.5.4 does not sanitize the metadata. This way its possible to insert XSS into plugins to execute JavaScript code.
CVSS Score
6.1
EPSS Score
0.007
Published
2021-05-26
Page 10