| Package | Affected versions | Patched versions |
|---|---|---|
| glpi | < 9.5.2 | 9.5.2 |
In GLPI before version 9.5.2, the `install/install.php` endpoint insecurely stores user input into the database as `url_base` and `url_base_api`. These settings are referenced throughout the application and allow for vulnerabilities like Cross-Site Scripting and Insecure Redirection Since authentication is not required to perform these changes,anyone could point these fields at malicious websites or form input in a way to trigger XSS. Leveraging JavaScript it's possible to steal cookies, perform actions as the user, etc. The issue is patched in version 9.5.2.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free