Vulnerability-Lookup

CNVD-2020-32422

Vulnerability from cnvd - Published: 2020-06-11

Title

Teclib GLPI跨站脚本漏洞（CNVD-2020-32422）

Description

Teclib GLPI是法国Teclib公司的一套开源的IT资产管理套件。该套件包含设备状态管理、资产清单存储、管理流程和工作日志管理等功能。 Teclib GLPI 9.4.6之前版本中的Knowledge base存在跨站脚本漏洞，远程攻击者可利用该漏洞在用户浏览器中注入任意HTML和脚本代码。

Severity

低

Patch Name

Teclib GLPI跨站脚本漏洞（CNVD-2020-32422）的补丁

Patch Description

Teclib GLPI是法国Teclib公司的一套开源的IT资产管理套件。该套件包含设备状态管理、资产清单存储、管理流程和工作日志管理等功能。 Teclib GLPI 9.4.6之前版本中的Knowledge base存在跨站脚本漏洞，远程攻击者可利用该漏洞在用户浏览器中注入任意HTML和脚本代码。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。

Formal description

厂商已发布了漏洞修复程序，请及时关注更新： https://github.com/glpi-project/glpi/security/advisories/GHSA-3g3h-rwhr-7385

Reference

https://github.com/glpi-project/glpi/security/advisories/GHSA-3g3h-rwhr-7385

Impacted products

Name
Teclib GLPI <9.4.6

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2020-11036"
    }
  },
  "description": "Teclib GLPI\u662f\u6cd5\u56fdTeclib\u516c\u53f8\u7684\u4e00\u5957\u5f00\u6e90\u7684IT\u8d44\u4ea7\u7ba1\u7406\u5957\u4ef6\u3002\u8be5\u5957\u4ef6\u5305\u542b\u8bbe\u5907\u72b6\u6001\u7ba1\u7406\u3001\u8d44\u4ea7\u6e05\u5355\u5b58\u50a8\u3001\u7ba1\u7406\u6d41\u7a0b\u548c\u5de5\u4f5c\u65e5\u5fd7\u7ba1\u7406\u7b49\u529f\u80fd\u3002\n\nTeclib GLPI 9.4.6\u4e4b\u524d\u7248\u672c\u4e2d\u7684Knowledge base\u5b58\u5728\u8de8\u7ad9\u811a\u672c\u6f0f\u6d1e\uff0c\u8fdc\u7a0b\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u5728\u7528\u6237\u6d4f\u89c8\u5668\u4e2d\u6ce8\u5165\u4efb\u610fHTML\u548c\u811a\u672c\u4ee3\u7801\u3002",
  "formalWay": "\u5382\u5546\u5df2\u53d1\u5e03\u4e86\u6f0f\u6d1e\u4fee\u590d\u7a0b\u5e8f\uff0c\u8bf7\u53ca\u65f6\u5173\u6ce8\u66f4\u65b0\uff1a\r\nhttps://github.com/glpi-project/glpi/security/advisories/GHSA-3g3h-rwhr-7385",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2020-32422",
  "openTime": "2020-06-11",
  "patchDescription": "Teclib GLPI\u662f\u6cd5\u56fdTeclib\u516c\u53f8\u7684\u4e00\u5957\u5f00\u6e90\u7684IT\u8d44\u4ea7\u7ba1\u7406\u5957\u4ef6\u3002\u8be5\u5957\u4ef6\u5305\u542b\u8bbe\u5907\u72b6\u6001\u7ba1\u7406\u3001\u8d44\u4ea7\u6e05\u5355\u5b58\u50a8\u3001\u7ba1\u7406\u6d41\u7a0b\u548c\u5de5\u4f5c\u65e5\u5fd7\u7ba1\u7406\u7b49\u529f\u80fd\u3002\r\n\r\nTeclib GLPI 9.4.6\u4e4b\u524d\u7248\u672c\u4e2d\u7684Knowledge base\u5b58\u5728\u8de8\u7ad9\u811a\u672c\u6f0f\u6d1e\uff0c\u8fdc\u7a0b\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u5728\u7528\u6237\u6d4f\u89c8\u5668\u4e2d\u6ce8\u5165\u4efb\u610fHTML\u548c\u811a\u672c\u4ee3\u7801\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "Teclib GLPI\u8de8\u7ad9\u811a\u672c\u6f0f\u6d1e\uff08CNVD-2020-32422\uff09\u7684\u8865\u4e01",
  "products": {
    "product": "Teclib GLPI \u003c9.4.6"
  },
  "referenceLink": "https://github.com/glpi-project/glpi/security/advisories/GHSA-3g3h-rwhr-7385",
  "serverity": "\u4f4e",
  "submitTime": "2020-05-06",
  "title": "Teclib GLPI\u8de8\u7ad9\u811a\u672c\u6f0f\u6d1e\uff08CNVD-2020-32422\uff09"
}

CVE-2020-11036 (GCVE-0-2020-11036)

Vulnerability from cvelistv5 – Published: 2020-05-05 21:35 – Updated: 2024-08-04 11:21

Title

XSS in GLPI

Summary

In GLPI before version 9.4.6 there are multiple related stored XSS vulnerabilities. The package is vulnerable to Stored XSS in the comments of items in the Knowledge base. Adding a comment with content "<script>alert(1)</script>" reproduces the attack. This can be exploited by a user with administrator privileges in the User-Agent field. It can also be exploited by an outside party through the following steps: 1. Create a user with the surname `" onmouseover="alert(document.cookie)` and an empty first name. 2. With this user, create a ticket 3. As an administrator (or other privileged user) open the created ticket 4. On the "last update" field, put your mouse on the name of the user 5. The XSS fires This is fixed in version 9.4.6.

Severity

7.6 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

GitHub_M mitre root Scorecard

References

3 references

URL	Tags
https://github.com/glpi-project/glpi/security/adv…	x_refsource_CONFIRM
https://lists.fedoraproject.org/archives/list/pac…	vendor-advisoryx_refsource_FEDORA
https://lists.fedoraproject.org/archives/list/pac…	vendor-advisoryx_refsource_FEDORA

Impacted products

1 product

Vendor	Product	Version
glpi-project	GLPI	Affected: < 9.4.6

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T11:21:14.475Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/glpi-project/glpi/security/advisories/GHSA-3g3h-rwhr-7385"
          },
          {
            "name": "FEDORA-2020-ee30e1109f",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Q4BG2UTINBVV7MTJRXKBQ26GV2UINA6L/"
          },
          {
            "name": "FEDORA-2020-885e2343ed",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5WQMONZRWLWOXMHMYWR7A5Q5JJERPMVC/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "GLPI",
          "vendor": "glpi-project",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 9.4.6"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In GLPI before version 9.4.6 there are multiple related stored XSS vulnerabilities. The package is vulnerable to Stored XSS in the comments of items in the Knowledge base. Adding a comment with content \"\u003cscript\u003ealert(1)\u003c/script\u003e\" reproduces the attack. This can be exploited by a user with administrator privileges in the User-Agent field. It can also be exploited by an outside party through the following steps: 1. Create a user with the surname `\" onmouseover=\"alert(document.cookie)` and an empty first name. 2. With this user, create a ticket 3. As an administrator (or other privileged user) open the created ticket 4. On the \"last update\" field, put your mouse on the name of the user 5. The XSS fires This is fixed in version 9.4.6."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.6,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-05-15T04:06:23.000Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/glpi-project/glpi/security/advisories/GHSA-3g3h-rwhr-7385"
        },
        {
          "name": "FEDORA-2020-ee30e1109f",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Q4BG2UTINBVV7MTJRXKBQ26GV2UINA6L/"
        },
        {
          "name": "FEDORA-2020-885e2343ed",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5WQMONZRWLWOXMHMYWR7A5Q5JJERPMVC/"
        }
      ],
      "source": {
        "advisory": "GHSA-3g3h-rwhr-7385",
        "discovery": "UNKNOWN"
      },
      "title": "XSS in GLPI",
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security-advisories@github.com",
          "ID": "CVE-2020-11036",
          "STATE": "PUBLIC",
          "TITLE": "XSS in GLPI"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "GLPI",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "\u003c 9.4.6"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "glpi-project"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "In GLPI before version 9.4.6 there are multiple related stored XSS vulnerabilities. The package is vulnerable to Stored XSS in the comments of items in the Knowledge base. Adding a comment with content \"\u003cscript\u003ealert(1)\u003c/script\u003e\" reproduces the attack. This can be exploited by a user with administrator privileges in the User-Agent field. It can also be exploited by an outside party through the following steps: 1. Create a user with the surname `\" onmouseover=\"alert(document.cookie)` and an empty first name. 2. With this user, create a ticket 3. As an administrator (or other privileged user) open the created ticket 4. On the \"last update\" field, put your mouse on the name of the user 5. The XSS fires This is fixed in version 9.4.6."
            }
          ]
        },
        "impact": {
          "cvss": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.6,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://github.com/glpi-project/glpi/security/advisories/GHSA-3g3h-rwhr-7385",
              "refsource": "CONFIRM",
              "url": "https://github.com/glpi-project/glpi/security/advisories/GHSA-3g3h-rwhr-7385"
            },
            {
              "name": "FEDORA-2020-ee30e1109f",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/Q4BG2UTINBVV7MTJRXKBQ26GV2UINA6L/"
            },
            {
              "name": "FEDORA-2020-885e2343ed",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5WQMONZRWLWOXMHMYWR7A5Q5JJERPMVC/"
            }
          ]
        },
        "source": {
          "advisory": "GHSA-3g3h-rwhr-7385",
          "discovery": "UNKNOWN"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2020-11036",
    "datePublished": "2020-05-05T21:35:12.000Z",
    "dateReserved": "2020-03-30T00:00:00.000Z",
    "dateUpdated": "2024-08-04T11:21:14.475Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CNVD-2020-32422

CVE-2020-11036 (GCVE-0-2020-11036)

Tags

Sightings

Nomenclature

Related by attack behaviour