Vulnerability · Published May 26, 2021 · Assigned by fedora
CVE-2021-3486
Medium 6.1
In plain English
A medium-severity cross-site scripting in glpi. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.4% (higher than 72% of all known vulnerabilities).
Severity (CVSS NVD)6.1Medium
Exploit odds (30 days)1.4%top 27.7% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
GLPi 9.5.4 does not sanitize the metadata. This way its possible to insert XSS into plugins to execute JavaScript code.
Affected products (as reported)
Weakness: CWE-79
References
- https://bugzilla.redhat.com/show_bug.cgi?id=1947653 x_refsource_MISC
- https://n3k00n3.github.io/blog/09042021/glpi_xss.html x_refsource_MISC
- https://github.com/Kitsun3Sec/exploits/tree/master/cms/GLPI/GLPI-stored-XSS x_refsource_MISC