CVE-2021-43778: Path traversal in GLPI barcode plugin
Barcode is a GLPI plugin for printing barcodes and QR codes. GLPI instances version 2.x prior to version 2.6.1 with the barcode plugin installed are vulnerable to a path traversal vulnerability. This issue was patched in version 2.6.1. As a workaround, delete the front/send.php file.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
GLPI Barcode pluginto a version that resolves this vulnerability.Fixed in 2.6.1 - Remove
Remove
GLPI Barcode pluginfrom your environment.Delete the front/send.php file as a workaround.
Event History
Frequently Asked Questions
What is the severity of CVE-2021-43778?
CVE-2021-43778 is classified as a path traversal vulnerability that could expose sensitive files.
How do I fix CVE-2021-43778?
To fix CVE-2021-43778, upgrade the GLPI Barcode Plugin to version 2.6.1 or later.
What software versions are affected by CVE-2021-43778?
CVE-2021-43778 affects GLPI Barcode Plugin versions 2.x prior to 2.6.1.
What consequences can result from exploiting CVE-2021-43778?
Exploiting CVE-2021-43778 can lead to unauthorized access to files on the server.
Is there a workaround for CVE-2021-43778 if I cannot upgrade?
Yes, as a temporary workaround, you can delete the front/send.php file in the GLPI installation.