CVE-2024-27104: Stored XSS in dashboards in GLPI
GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. A user with rights to create and share dashboards can build a dashboard containing javascript code. Any user that will open this dashboard will be subject to an XSS attack. This issue has been patched in version 10.0.13.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-27104?
CVE-2024-27104 has been classified as a high severity vulnerability due to the potential for cross-site scripting attacks.
How do I fix CVE-2024-27104?
To fix CVE-2024-27104, upgrade GLPI to version 10.0.13 or later.
What versions of GLPI are affected by CVE-2024-27104?
CVE-2024-27104 affects GLPI versions from 9.5.0 to 10.0.12 inclusive.
What potential impact does CVE-2024-27104 have on my system?
CVE-2024-27104 can allow an attacker to execute arbitrary JavaScript code in the context of the user's browser.
Who can exploit CVE-2024-27104?
Any user with rights to create and share dashboards in GLPI can exploit CVE-2024-27104.