Vulnerability Database

300,830

Total vulnerabilities in the database

CVE-2020-11035

In GLPI after version 0.83.3 and before version 9.4.6, the CSRF tokens are generated using an insecure algorithm. The implementation uses rand and uniqid and MD5 which does not provide secure values. This is fixed in version 9.4.6.

  • Published: May 6, 2020
  • Updated: Apr 13, 2023
  • CVE: CVE-2020-11035
  • Severity: Critical
  • Exploit:

CVSS v3:

  • Severity: Critical
  • Score: 9.3
  • AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N

CVSS v2:

  • Severity: Medium
  • Score: 6.4
  • AV:N/AC:L/Au:N/C:P/I:P/A:N

CWEs:

OWASP TOP 10:

Software From Fixed in
glpi-project / glpi 0.83.3 9.4.6
fedoraproject / fedora 31 31.x
fedoraproject / fedora 32 32.x