CVE-2024-27104

Name of the Vulnerable Software and Affected Versions GLPI versions prior to 10.0.13

Description The issue is related to improper input neutralization during web page creation, allowing a remote attacker to conduct a cross-site scripting (XSS) attack. A user with rights to create and share dashboards can build a dashboard containing javascript code, and any user who opens this dashboard will be subject to an XSS attack.

Recommendations For versions prior to 10.0.13, update to version 10.0.13 to resolve the issue. As a temporary workaround, consider restricting access to dashboard creation and sharing features to minimize the risk of exploitation. Avoid using dashboards that contain javascript code until the issue is resolved.