CVE-2020-15175
moderate-risk
Published 2020-10-07
In GLPI before version 9.5.2, the `pluginimage.send.php` endpoint allows a user to specify an image from a plugin. The parameters can be maliciously crafted to instead delete the .htaccess file for the files directory. Any user becomes able to read all the files and folders contained in “/files/”. Some of the sensitive information that is compromised are the user sessions, logs, and more. An attacker would be able to get the Administrators session token and use that to authenticate. The issue is patched in version 9.5.2.
Do I need to act?
!
12.9% chance of exploitation in next 30 days
EPSS score — higher than 87% of all CVEs
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
7
CVSS 7.4/10
High
NETWORK
/ HIGH complexity
Affected Products (1)
Affected Vendors
References (4)
Third Party Advisory
https://github.com/glpi-project/glpi/security/advisories/GHSA-rm52-jx9h-rwcp
Third Party Advisory
https://github.com/glpi-project/glpi/security/advisories/GHSA-rm52-jx9h-rwcp
39
/ 100
moderate-risk
Severity
22/34 · High
Exploitability
12/34 · Low
Exposure
5/34 · Minimal