Cedric-Anne

An issue exists where a technician can store a Cross-Site Scripting (XSS) payload within ITIL costs. XSS is a type of security flaw that allows an attacker to inject malicious scripts into web pages viewed by other users.

GLPI is an Asset and IT Management Software package. A technician can utilize a malicious payload to trigger a stored Cross-Site Scripting (XSS) issue on the project's kanban.

The issue is related to an unlimited file upload vulnerability in the GLPI system, which can be exploited by a remote attacker to upload arbitrary files to the system. This can potentially allow the deletion of some files by diverting the document upload process. The GLPI system is a free asset and IT management software package that provides ITIL Service Desk features, licenses tracking, and software auditing.

The issue is related to insufficient cleaning of user data when processing external links, allowing a user to inject and execute arbitrary HTML code and scripts in the user's browser within the context of the vulnerable website. This can enable a remote attacker to steal potentially confidential information, modify the appearance of web pages, and perform phishing and drive-by download attacks.

The issue allows unauthorized access to inventory files. If anonymous access to FAQ is allowed, inventory files become accessible by unauthenticated users.

The SCCM plugin for GLPI has an issue where the Configuration page is publicly accessible in read-only mode in versions prior to 2.3.0. This issue is patched in version 2.3.0.

The issue is related to improper input neutralization during web page creation, allowing a remote attacker to conduct a cross-site scripting (XSS) attack. A user with rights to create and share dashboards can build a dashboard containing javascript code, and any user who opens this dashboard will be subject to an XSS attack.

A plugin public script can be used to read the content of system files.