CVE-2021-21313

GLPI is open source software which stands for Gestionnaire Libre de Parc Informatique and it is a Free Asset and IT Management Software package. In GLPI before verison 9.5.4, there is a vulnerability in the /ajax/common.tabs.php endpoint, indeed, at least two parameters _target and id are not properly sanitized. Here are two payloads (due to two different exploitations depending on which parameter you act) to exploit the vulnerability:/ajax/common.tabs.php?_target=javascript:alert(document.cookie)&_itemtype=DisplayPreference&_glpi_tab=DisplayPreference$2&id=258&displaytype=Ticket (Payload triggered if you click on the button). /ajax/common.tabs.php?_target=/front/ticket.form.php&_itemtype=Ticket&_glpi_tab=Ticket$1&id=(){};(function%20(){alert(document.cookie);})();function%20a&#.
Configurations

Configuration 1 (hide)

cpe:2.3:a:glpi-project:glpi:*:*:*:*:*:*:*:*

History

24 Oct 2022, 17:07

Type Values Removed Values Added
CWE CWE-74 CWE-79
CVSS v2 : 4.0
v3 : 4.9
v2 : 4.3
v3 : 6.1

Information

Published : 2021-03-03 20:15

Updated : 2024-02-04 21:23


NVD link : CVE-2021-21313

Mitre link : CVE-2021-21313

CVE.ORG link : CVE-2021-21313


JSON object : View

Products Affected

glpi-project

  • glpi
CWE
CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CWE-74

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')