CVE-2020-15175: Unauthenticated File Deletion in GLPI
In GLPI before version 9.5.2, the ?pluginimage.send.php? endpoint allows a user to specify an image from a plugin. The parameters can be maliciously crafted to instead delete the .htaccess file for the files directory. Any user becomes able to read all the files and folders contained in “/files/”. Some of the sensitive information that is compromised are the user sessions, logs, and more. An attacker would be able to get the Administrators session token and use that to authenticate. The issue is patched in version 9.5.2.
Other sources
In GLPI before version 9.5.2, the pluginimage.send.php endpoint allows a user to specify an image from a plugin. The parameters can be maliciously crafted to instead delete the .htaccess file for the files directory. Any user becomes able to read all the files and folders contained in “/files/”. Some of the sensitive information that is compromised are the user sessions, logs, and more. An attacker would be able to get the Administrators session token and use that to authenticate. The issue is patched in version 9.5.2.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2020-15175?
CVE-2020-15175 is classified as a medium severity vulnerability.
How do I fix CVE-2020-15175?
To fix CVE-2020-15175, upgrade GLPI to version 9.5.2 or later.
What type of security issue does CVE-2020-15175 represent?
CVE-2020-15175 represents a directory traversal vulnerability that can lead to unauthorized file access.
Who is affected by CVE-2020-15175?
Any user utilizing GLPI versions prior to 9.5.2 is affected by CVE-2020-15175.
Can CVE-2020-15175 lead to data exposure?
Yes, CVE-2020-15175 can allow unauthorized users to read sensitive files and folders.