CVE-2020-11035: weak CSRF tokens in GLPI
Published May 5, 2020
·Updated
In GLPI after version 0.83.3 and before version 9.4.6, the CSRF tokens are generated using an insecure algorithm. The implementation uses rand and uniqid and MD5 which does not provide secure values. This is fixed in version 9.4.6.
Affected Software
3 affected components
GLPI-PROJECT GLPI>=0.83.3<9.4.6
Fedoraproject Fedora=31
Fedoraproject Fedora=32
Event History
May 5, 2020
CVE Published
via MITRE·09:30 PM
Data Sourced
via MITRE·09:30 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the severity of CVE-2020-11035?
CVE-2020-11035 has been classified as a medium severity vulnerability due to its potential impact on application security.
2
How do I fix CVE-2020-11035?
To fix CVE-2020-11035, upgrade GLPI to version 9.4.6 or later, which addresses the insecure CSRF token generation.
3
Which versions of GLPI are affected by CVE-2020-11035?
GLPI versions after 0.83.3 and before 9.4.6 are affected by CVE-2020-11035.
4
What type of vulnerability is CVE-2020-11035?
CVE-2020-11035 is a Cross-Site Request Forgery (CSRF) vulnerability caused by insecure token generation.
5
Is Fedora impacted by CVE-2020-11035?
Yes, Fedora users should be aware of CVE-2020-11035 if they are using affected versions of GLPI.