National Cyber Awareness System

Vulnerability Summary for CVE-2011-2720

Overview

The autocompletion functionality in GLPI before 0.80.2 does not blacklist certain username and password fields, which allows remote attackers to obtain sensitive information via a crafted POST request.

Impact

CVSS Severity (version 2.0):

CVSS Version 2 Metrics:

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

External Source: CONFIRM

Name: https://forge.indepnet.net/projects/glpi/repository/revisions/14966

Type: Patch Information

Hyperlink:https://forge.indepnet.net/projects/glpi/repository/revisions/14966

External Source: CONFIRM

Name: https://forge.indepnet.net/projects/glpi/repository/revisions/14960

Type: Patch Information

Hyperlink:https://forge.indepnet.net/projects/glpi/repository/revisions/14960

External Source: CONFIRM

Name: https://forge.indepnet.net/projects/glpi/repository/revisions/14958

Type: Patch Information

Hyperlink:https://forge.indepnet.net/projects/glpi/repository/revisions/14958

External Source: CONFIRM

Name: https://forge.indepnet.net/projects/glpi/repository/revisions/14957

Type: Patch Information

Hyperlink:https://forge.indepnet.net/projects/glpi/repository/revisions/14957

External Source: CONFIRM

Name: https://forge.indepnet.net/projects/glpi/repository/revisions/14956

Type: Patch Information

Hyperlink:https://forge.indepnet.net/projects/glpi/repository/revisions/14956

External Source: CONFIRM

Name: https://forge.indepnet.net/projects/glpi/repository/revisions/14955

Type: Patch Information

Hyperlink:https://forge.indepnet.net/projects/glpi/repository/revisions/14955

External Source: CONFIRM

Name: https://forge.indepnet.net/projects/glpi/repository/revisions/14954

Type: Patch Information

Hyperlink:https://forge.indepnet.net/projects/glpi/repository/revisions/14954

External Source: CONFIRM

Name: https://forge.indepnet.net/projects/glpi/repository/revisions/14952

Type: Patch Information

Hyperlink:https://forge.indepnet.net/projects/glpi/repository/revisions/14952

External Source: CONFIRM

Name: https://forge.indepnet.net/projects/glpi/repository/revisions/14951

Type: Patch Information

Hyperlink:https://forge.indepnet.net/projects/glpi/repository/revisions/14951

External Source: CONFIRM

Name: https://bugzilla.redhat.com/show_bug.cgi?id=726185

Type: Patch Information

Hyperlink:https://bugzilla.redhat.com/show_bug.cgi?id=726185

External Source: MLIST

Name: [oss-security] 20110726 Re: CVE Request -- GLPI -- Properly blacklist some sensitive fields

Type: Patch Information

Hyperlink:http://www.openwall.com/lists/oss-security/2011/07/26/11

External Source: MLIST

Name: [oss-security] 20110725 CVE Request -- GLPI -- Properly blacklist some sensitive fields

Type: Patch Information

Hyperlink:http://www.openwall.com/lists/oss-security/2011/07/25/7

External Source: CONFIRM

Name: https://forge.indepnet.net/projects/glpi/versions/605

Hyperlink:https://forge.indepnet.net/projects/glpi/versions/605

External Source: CONFIRM

Name: https://forge.indepnet.net/issues/3017

Hyperlink:https://forge.indepnet.net/issues/3017

External Source: BID

Name: 48884

Hyperlink:http://www.securityfocus.com/bid/48884

External Source: MANDRIVA

Name: MDVSA-2012:014

Hyperlink:http://www.mandriva.com/security/advisories?name=MDVSA-2012:014

External Source: CONFIRM

Name: http://www.glpi-project.org/spip.php?page=annonce&id_breve=237&lang=en

Hyperlink:http://www.glpi-project.org/spip.php?page=annonce&id_breve=237&lang=en

External Source: SECUNIA

Name: 45542

Hyperlink:http://secunia.com/advisories/45542

External Source: SECUNIA

Name: 45366

Type: Advisory

Hyperlink:http://secunia.com/advisories/45366

External Source: FEDORA

Name: FEDORA-2011-9690

Hyperlink:http://lists.fedoraproject.org/pipermail/package-announce/2011-August/063679.html

External Source: FEDORA

Name: FEDORA-2011-9639

Hyperlink:http://lists.fedoraproject.org/pipermail/package-announce/2011-August/063408.html