CVE-2024-45611: GLPI has a stored XSS at src/RSSFeed.php
GLPI is an open-source asset and IT management software package that provides ITIL Service Desk features, licenses tracking and software auditing. An authenticated user can bypass the access control policy to create a private RSS feed attached to another user account and use a malicious payload to triggger a stored XSS. Upgrade to 10.0.17.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-45611?
CVE-2024-45611 has a medium severity rating due to the potential for unauthorized access to user accounts.
How do I fix CVE-2024-45611?
To fix CVE-2024-45611, upgrade GLPI to version 10.0.18 or later, which addresses the vulnerability.
Who is affected by CVE-2024-45611?
Authenticated users of GLPI versions prior to 10.0.18 can be affected by CVE-2024-45611.
What type of vulnerability is CVE-2024-45611?
CVE-2024-45611 is an access control vulnerability that allows users to create unauthorized private RSS feeds.
Can CVE-2024-45611 lead to data exposure?
Yes, CVE-2024-45611 can potentially lead to data exposure by allowing maleficent users to access another user's resource.