In GLPI before version 9.4.6 there are multiple related stored XSS vulnerabilities. The package is vulnerable to Stored XSS in the comments of items in the Knowledge base. Adding a comment with content "<script>alert(1)</script>" reproduces the attack. This can be exploited by a user with administrator privileges in the User-Agent field. It can also be exploited by an outside party through the following steps: 1. Create a user with the surname `" onmouseover="alert(document.cookie)` and an empty first name. 2. With this user, create a ticket 3. As an administrator (or other privileged user) open the created ticket 4. On the "last update" field, put your mouse on the name of the user 5. The XSS fires This is fixed in version 9.4.6.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - In GLPI before version 9.4.6 there are multiple related stored XSS vulnerabilities. The package is     vulnerable to Stored XSS in the comments of items in the Knowledge base. Adding a comment with content     <script>alert(1)</script> reproduces the attack. This can be exploited by a user with administrator     privileges in the User-Agent field. It can also be exploited by an outside party through the following     steps: 1. Create a user with the surname ` onmouseover=alert(document.cookie)` and an empty first name.
    2. With this user, create a ticket 3. As an administrator (or other privileged user) open the created     ticket 4. On the last update field, put your mouse on the name of the user 5. The XSS fires This is     fixed in version 9.4.6. (CVE-2020-11036)

Note that Nessus relies on the presence of the package as reported by the vendor.

MITRE Corporation reports :

In GLPI before version 9.4.6 there are multiple related stored XSS vulnerabilities. The package is vulnerable to Stored XSS in the comments of items in the Knowledge base. Adding a comment with content 'alert(1)' reproduces the attack. This can be exploited by a user with administrator privileges in the User-Agent field. It can also be exploited by an outside party through the following steps: 1. Create a user with the surname `' onmouseover='alert(document.cookie)` and an empty first name. 2. With this user, create a ticket 3. As an administrator (or other privileged user) open the created ticket 4. On the 'last update' field, put your mouse on the name of the user 5. The XSS fires This is fixed in version 9.4.6.

Last Upstream release, including (among others) :

  - (security) Prevent execution of SQL injection while     assigning a technician,

  - (security) Permit to change key used to store passwords,

  - (security) Improve CSRF token,

  - (security) Fix several possible XSS,

  - (security) Fix a few possible SQL injections,

  - Fix SCSS caching issues,

  - Fix inline images handling on item update,

  - Fix PHP 7.4 compatibility,

  - Connect to database using socket,

  - ...

Full changelog at https://github.com/glpi-project/glpi/milestone/39?closed=1

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
260874	Linux Distros Unpatched Vulnerability : CVE-2020-11036	Nessus	Misc.	medium
144182	FreeBSD : glpi -- multiple related stored XSS vulnerabilities (27a230a2-3b11-11eb-af2a-080027dbe4b7)	Nessus	FreeBSD Local Security Checks	medium
136594	Fedora 31 : glpi (2020-885e2343ed)	Nessus	Fedora Local Security Checks	critical

Detections

Analytics

CVE-2020-11036

medium

Tenable Plugins

medium

medium

critical