Vulnerability · Published May 5, 2020 · Assigned by GitHub_M

CVE-2020-11033Able to read any token through API user endpoint in GLPI

Medium 6.6

In plain English

A medium-severity information exposure in GLPI from glpi-project. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.0% (higher than 64% of all known vulnerabilities).

Severity (CVSS 3.1)6.6Medium

Exploit odds (30 days)1.0%top 35.9% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

In GLPI from version 9.1 and before version 9.4.6, any API user with READ right on User itemtype will have access to full list of users when querying apirest.php/User. The response contains: - All api_tokens which can be used to do privileges escalations or read/update/delete data normally non accessible to the current user. - All personal_tokens can display another users planning. Exploiting this vulnerability requires the api to be enabled, a technician account. It can be mitigated by adding an application token. This is fixed in version 9.4.6.

Affected products (as reported)

Vendor	Product	Versions
glpi-project	GLPI	>9.1, < 9.4.6

Weakness: CWE-200 · Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:L/A:N

References

https://github.com/glpi-project/glpi/security/advisories/GHSA-rf54-3r4w-4h55 x_refsource_CONFIRM
FEDORA-2020-ee30e1109f vendor-advisory, x_refsource_FEDORA
FEDORA-2020-885e2343ed vendor-advisory, x_refsource_FEDORA