Insecure Permissions Affecting glpi/glpi package, versions <9.5.3
Threat Intelligence
Exploit Maturity
Mature
EPSS
0.12% (48th
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-PHP-GLPIGLPI-1046564
- published 27 Nov 2020
- disclosed 27 Nov 2020
- credit Unknown
Introduced: 27 Nov 2020
CVE-2020-26212 Open this link in a new tabHow to fix?
Upgrade glpi/glpi to version 9.5.3 or higher.
Overview
glpi/glpi is a free Asset and IT Management Software package with ITIL Service Desk, licenses tracking and software auditing.
Affected versions of this package are vulnerable to Insecure Permissions. Any authenticated user has read-only permissions to the planning of every other user, even admin ones.
PoC
1. Create a new planning with 'eduardo.mozart' user (from 'IT' group that belongs to 'Super-admin') into it's personal planning at 'Assistance' > 'Planning'.
2. Copy the CalDAV url and use a CalDAV client (e.g. Thunderbird) to sync the planning with the provided URL.
3. Inform the username and password from any valid user (e.g. 'camila' from 'Proativa' group).
4. 'Camila' has read-only access to 'eduardo.mozart' personal planning. The same behavior happens to any group. E.g. 'Camila' has access to 'IT' group planning, even if she doesn't belong to this group and has a 'Self-service' profile permission).
References
CVSS Scores
version 3.1