Description
In GLPI before version 9.4.6, there is a vulnerability that allows bypassing the open redirect protection based which is based on a regexp. This is fixed in version 9.4.6.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| glpi-project | GLPI | < 9.4.6 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 16.04 LTS | glpi | No fix yet | — |
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- GLPI <9.4.6 - Open Redirect http/cves/2020/CVE-2020-11034.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.
References
- https://github.com/glpi-project/glpi/security/advisories/GHSA-gxv6-xq9q-37hg
- FEDORA-2020-ee30e1109f vendor-advisory
- FEDORA-2020-885e2343ed vendor-advisory