CVE-2018-7563: XSS
An issue was discovered in GLPI through 9.2.1. The application is affected by XSS in the query string to front/preference.php. An attacker is able to create a malicious URL that, if opened by an authenticated user with debug privilege, will execute JavaScript code supplied by the attacker. The attacker-supplied code can perform a wide variety of actions, such as stealing the victim's session token or login credentials, performing arbitrary actions on the victim's behalf, and logging their keystrokes.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2018-7563?
CVE-2018-7563 has been classified as a moderate severity Cross-Site Scripting (XSS) vulnerability.
How does CVE-2018-7563 affect users?
CVE-2018-7563 allows an attacker to execute malicious JavaScript in the context of an authenticated user's session if they visit a specially crafted URL.
Who is impacted by CVE-2018-7563?
Users of GLPI versions up to and including 9.2.1 who have debug privileges are impacted by CVE-2018-7563.
How can I fix CVE-2018-7563?
To fix CVE-2018-7563, it is recommended to upgrade GLPI to a version that is higher than 9.2.1.
What types of attacks can be executed through CVE-2018-7563?
CVE-2018-7563 can be exploited to perform XSS attacks, allowing an attacker to manipulate the web page and execute scripts in the user's browser.