CVE-2021-3486: XSS
GLPi 9.5.4 does not sanitize the metadata. This is way its possible to insert XSS into plugins to execute JavaScript code.
References:
https://github.com/Kitsun3Sec/exploits/tree/master/cms/GLPI/GLPI-stored-XSS https://n3k00n3.github.io/blog/09042021/glpixss.html
Other sources
GLPi 9.5.4 does not sanitize the metadata. This way its possible to insert XSS into plugins to execute JavaScript code.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/glpito a version that resolves this vulnerability.Fixed in 9.5.5
Event History
Frequently Asked Questions
What is the severity of CVE-2021-3486?
CVE-2021-3486 is classified as a medium severity vulnerability due to its ability to execute JavaScript code via stored XSS in GLPi.
How do I fix CVE-2021-3486?
To fix CVE-2021-3486, upgrade GLPi to version 9.5.5 or higher, which addresses the XSS vulnerability.
What are the affected versions of GLPi for CVE-2021-3486?
The affected version for CVE-2021-3486 is GLPi 9.5.4, which contains the vulnerability.
Can CVE-2021-3486 impact any plugins?
Yes, CVE-2021-3486 can impact plugins within GLPi as it allows the injection of malicious JavaScript code.
What types of attacks can CVE-2021-3486 facilitate?
CVE-2021-3486 can facilitate cross-site scripting (XSS) attacks, potentially compromising user data and session information.