Moderatetrasher

**Name of the Vulnerable Software and Affected Versions** GLPI versions 9.5.0 through 10.0.17 **Description** The issue allows unauthorized access to GLPI when a "Mail servers" authentication provider is configured to use an Oauth connection provided by the OauthIMAP plugin, leveraging existing Oauth authorizations. **Recommendations** For versions 9.5.0 through 10.0.17, update to version 10.0.18 to resolve the issue. As a temporary workaround, consider disabling any "Mail servers" authentication provider configured to use an Oauth connection provided by the OauthIMAP plugin.

**Name of the Vulnerable Software and Affected Versions** GLPI versions prior to 9.5.3 **Description** The issue allows any authenticated user to have read-only permissions to the planning of every other user, including admin ones. This can be reproduced by creating a new planning, copying the CalDAV URL, and using a CalDAV client to sync the planning with the provided URL and credentials of any valid user. The same behavior happens to any group, allowing users to access planning even if they don't belong to that group. **Recommendations** For versions prior to 9.5.3, update to version 9.5.3 to resolve the issue. As a temporary workaround, consider removing the `caldav.php` file to block access to the CalDAV server.

**Name of the Vulnerable Software and Affected Versions** GLPI versions 9.5.0 through 9.5.1 **Description** The issue concerns a leakage of user information through the public FAQ. It was introduced in version 9.5.0 and patched in 9.5.2. **Recommendations** For GLPI versions 9.5.0 through 9.5.1, as a workaround, disable public access to the FAQ. Update to version 9.5.2 to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** GLPI versions prior to 9.4.6 **Description** The issue involves a default encryption key, GLPIKEY, which is public and used across all instances. This allows unauthorized parties to decrypt sensitive data stored with this key. The key can be changed before installing GLPI, but for existing instances, data must be reencrypted with the new key. However, it's challenging to identify which columns or rows in the database use this key, especially for plugins. Changing the key without updating the data can lead to issues with password sending, but re-storing the data from the UI can resolve this. **Recommendations** For versions prior to 9.4.6, update to version 9.4.6 or later to resolve the issue. Additionally, consider reencrypting sensitive data with a new key, and re-store the data from the UI to avoid password sending issues. If possible, change the default encryption key before installing GLPI to prevent this issue.