Cedric-Anne

توجد مشكلة تسمح للفني بتخزين حمولة برمجية من نوع «التنفيذ البرمجي عبر المواقع» (XSS) ضمن تكاليف ITIL. XSS هو نوع من الثغرات الأمنية التي تسمح للمهاجم بإدخال نصوص برمجية ضارة في صفحات الويب التي يشاهدها المستخدمون الآخرون.

GLPI عبارة عن حزمة برمجيات لإدارة الأصول وتكنولوجيا المعلومات. يمكن لأي فني استخدام حمولة ضارة لإحداث ثغرة في البرمجة عبر المواقع (XSS) مخزنة في لوحة كانبان الخاصة بالمشروع.

The issue is related to an unlimited file upload vulnerability in the GLPI system, which can be exploited by a remote attacker to upload arbitrary files to the system. This can potentially allow the deletion of some files by diverting the document upload process. The GLPI system is a free asset and IT management software package that provides ITIL Service Desk features, licenses tracking, and software auditing.

The issue is related to insufficient cleaning of user data when processing external links, allowing a user to inject and execute arbitrary HTML code and scripts in the user's browser within the context of the vulnerable website. This can enable a remote attacker to steal potentially confidential information, modify the appearance of web pages, and perform phishing and drive-by download attacks.

The issue allows unauthorized access to inventory files. If anonymous access to FAQ is allowed, inventory files become accessible by unauthenticated users.

The SCCM plugin for GLPI has an issue where the Configuration page is publicly accessible in read-only mode in versions prior to 2.3.0. This issue is patched in version 2.3.0.

The issue is related to improper input neutralization during web page creation, allowing a remote attacker to conduct a cross-site scripting (XSS) attack. A user with rights to create and share dashboards can build a dashboard containing javascript code, and any user who opens this dashboard will be subject to an XSS attack.

A plugin public script can be used to read the content of system files.