CVE-2020-11033 - Able to read any token through API user endpoint in GLPI

Back Back to CVE browser

HIGH

Able to read any token through API user endpoint in GLPI

Published May 5, 2020

7.2

HIGH

CVSS 3.1

EPSS 1.04%

Description

In GLPI from version 9.1 and before version 9.4.6, any API user with READ right on User itemtype will have access to full list of users when querying apirest.php/User. The response contains: - All api_tokens which can be used to do privileges escalations or read/update/delete data normally non accessible to the current user. - All personal_tokens can display another users planning. Exploiting this vulnerability requires the api to be enabled, a technician account. It can be mitigated by adding an application token. This is fixed in version 9.4.6.

Affected products

Vendor Glpi-Project Product GLPI Default
n/a
- Version
  >9.1, < 9.4.6
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Glpi-Project

GLPI

n/a

Version	Status	Constraints
>9.1, < 9.4.6	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-200

Exposure of Sensitive Information

References (4)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-3418
Advisory
https://github.com/glpi-project/glpi/security/advisories/GHSA-rf54-3r4w-4h55
x_refsource_CONFIRMVendor Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5WQMONZRWLWOXMHMYWR7A5Q5JJERPMVC/
vendor-advisoryx_refsource_FEDORA
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Q4BG2UTINBVV7MTJRXKBQ26GV2UINA6L/
vendor-advisoryx_refsource_FEDORA

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-3418		Advisory
https://github.com/glpi-project/glpi/security/advisories/GHSA-rf54-3r4w-4h55		x_refsource_CONFIRMVendor Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5WQMONZRWLWOXMHMYWR7A5Q5JJERPMVC/		vendor-advisoryx_refsource_FEDORA
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Q4BG2UTINBVV7MTJRXKBQ26GV2UINA6L/		vendor-advisoryx_refsource_FEDORA