CVE-2021-21312

{"id": "CVE-2021-21312", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 3.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N", "authentication": "SINGLE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "LOW", "obtainAllPrivilege": false, "exploitabilityScore": 6.8, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 4.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 1.7}, {"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "NONE"}, "impactScore": 4.0, "exploitabilityScore": 1.0}]}, "published": "2021-03-03T20:15:12.060", "references": [{"url": "https://github.com/glpi-project/glpi/releases/tag/9.5.4", "tags": ["Release Notes", "Third Party Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/glpi-project/glpi/security/advisories/GHSA-c7f6-3mr7-3rq2", "tags": ["Third Party Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "GLPI is open source software which stands for Gestionnaire Libre de Parc Informatique and it is a Free Asset and IT Management Software package. In GLPI before verison 9.5.4, there is a vulnerability within the document upload function (Home > Management > Documents > Add, or /front/document.form.php endpoint), indeed one of the form field: \"Web Link\" is not properly sanitized and a malicious user (who has document upload rights) can use it to deliver JavaScript payload. For example if you use the following payload: \" accesskey=\"x\" onclick=\"alert(1)\" x=\", the content will be saved within the database without any control. And then once you return to the summary documents page, by clicking on the \"Web Link\" of the newly created file it will create a new empty tab, but on the initial tab the pop-up \"1\" will appear."}, {"lang": "es", "value": "GLPI es un software de c\u00f3digo abierto que significa Gestionnaire Libre de Parc Informatique y es un paquete gratuito de Software de Gesti\u00f3n de Activos y TI. En GLPI anterior a la versi\u00f3n 9.5.4, se presenta una vulnerabilidad dentro de la funci\u00f3n de carga de documentos (Home ) Management ) Documents ) Add, o el archivo /front/document.form.php endpoint), de hecho, uno de los campos de formulario: \"Web Link\" es no est\u00e1 debidamente saneado y un usuario malicioso (que tiene derechos de carga de documentos) puede usarlo para entregar la carga \u00fatil de JavaScript. Por ejemplo, si usa la siguiente carga \u00fatil: \" accesskey=\"x\" onclick=\"alert(1)\" x=\", el contenido se guardar\u00e1 dentro de la base de datos sin ning\u00fan control. Y luego, una vez que regrese a la p\u00e1gina de documentos resumen, al hacer clic en el \"Web Link\" del archivo reci\u00e9n creado, se crear\u00e1 una nueva pesta\u00f1a vac\u00eda, pero en la pesta\u00f1a inicial aparecer\u00e1 la ventana emergente \"1\""}], "lastModified": "2021-03-10T17:22:13.437", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:glpi-project:glpi:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9506B7CC-727B-40FE-B5A3-69B362E1ACEB", "versionEndExcluding": "9.5.4"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}