CVE-2024-47759: GLPI has a stored XSS via document upload
GLPI is a free Asset and IT management software package. An technician can upload a SVG containing a malicious script. The script will then be executed when any user will try to see the document contents. Upgrade to 10.0.17.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-47759?
CVE-2024-47759 is considered a critical vulnerability as it allows an attacker to execute malicious scripts through uploaded SVG files.
How do I fix CVE-2024-47759?
To fix CVE-2024-47759, upgrade GLPI to version 10.0.17 or later to eliminate the vulnerability.
What versions of GLPI are affected by CVE-2024-47759?
CVE-2024-47759 affects GLPI versions from 9.2.0 up to but not including 10.0.17.
What kind of attack does CVE-2024-47759 facilitate?
CVE-2024-47759 facilitates attacks where malicious scripts can be executed when a user views a compromised SVG document.
Who is impacted by the CVE-2024-47759 vulnerability?
Any user of GLPI versions prior to 10.0.17 is potentially at risk from the CVE-2024-47759 vulnerability.