An issue was discovered in GLPI through 9.2.1. The application is affected by XSS in the query string to front/preference.php. An attacker is able to create a malicious URL that, if opened by an authenticated user with debug privilege, will execute JavaScript code supplied by the attacker. The attacker-supplied code can perform a wide variety of actions, such as stealing the victim's session token or login credentials, performing arbitrary actions on the victim's behalf, and logging their keystrokes.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - An issue was discovered in GLPI through 9.2.1. The application is affected by XSS in the query string to     front/preference.php. An attacker is able to create a malicious URL that, if opened by an authenticated     user with debug privilege, will execute JavaScript code supplied by the attacker. The attacker-supplied     code can perform a wide variety of actions, such as stealing the victim's session token or login     credentials, performing arbitrary actions on the victim's behalf, and logging their keystrokes.
    (CVE-2018-7563)

Note that Nessus relies on the presence of the package as reported by the vendor.

escape get keys to prevent possible xss CVE-2018-7563

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
260864	Linux Distros Unpatched Vulnerability : CVE-2018-7563	Nessus	Misc.	medium
108672	Fedora 26 : glpi (2018-b0f6a5bdbc)	Nessus	Fedora Local Security Checks	medium
108667	Fedora 27 : glpi (2018-1b67b3a3a3)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2018-7563

medium

Tenable Plugins

medium

medium

medium