In GLPI from version 9.1 and before version 9.4.6, any API user with READ right on User itemtype will have access to full list of users when querying apirest.php/User. The response contains: - All api_tokens which can be used to do privileges escalations or read/update/delete data normally non accessible to the current user. - All personal_tokens can display another users planning. Exploiting this vulnerability requires the api to be enabled, a technician account. It can be mitigated by adding an application token. This is fixed in version 9.4.6.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - In GLPI from version 9.1 and before version 9.4.6, any API user with READ right on User itemtype will have     access to full list of users when querying apirest.php/User. The response contains: - All api_tokens which     can be used to do privileges escalations or read/update/delete data normally non accessible to the current     user. - All personal_tokens can display another users planning. Exploiting this vulnerability requires the     api to be enabled, a technician account. It can be mitigated by adding an application token. This is fixed     in version 9.4.6. (CVE-2020-11033)

Note that Nessus relies on the presence of the package as reported by the vendor.

MITRE Corporation reports :

In GLPI from version 9.1 and before version 9.4.6, any API user with READ right on User itemtype will have access to full list of users when querying apirest.php/User. The response contains: - All api_tokens which can be used to do privileges escalations or read/update/delete data normally non accessible to the current user. - All personal_tokens can display another users planning. Exploiting this vulnerability requires the api to be enabled, a technician account. It can be mitigated by adding an application token. This is fixed in version 9.4.6.

Last Upstream release, including (among others) :

  - (security) Prevent execution of SQL injection while     assigning a technician,

  - (security) Permit to change key used to store passwords,

  - (security) Improve CSRF token,

  - (security) Fix several possible XSS,

  - (security) Fix a few possible SQL injections,

  - Fix SCSS caching issues,

  - Fix inline images handling on item update,

  - Fix PHP 7.4 compatibility,

  - Connect to database using socket,

  - ...

Full changelog at https://github.com/glpi-project/glpi/milestone/39?closed=1

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
260797	Linux Distros Unpatched Vulnerability : CVE-2020-11033	Nessus	Misc.	high
144126	FreeBSD : glpi -- able to read any token through API user endpoint (aec9cbe0-3b0f-11eb-af2a-080027dbe4b7)	Nessus	FreeBSD Local Security Checks	high
136594	Fedora 31 : glpi (2020-885e2343ed)	Nessus	Fedora Local Security Checks	critical

Detections

Analytics

CVE-2020-11033

high

Tenable Plugins

high

high

critical