CVE-2020-15108 : Security Advisory and Response

In glpi before 9.5.1, a SQL injection vulnerability exists in all uses of the "Clone" feature, which has been addressed in version 9.5.1.

Understanding CVE-2020-15108

This CVE involves a SQL injection vulnerability in the glpi software.

What is CVE-2020-15108?

It is a security vulnerability in glpi versions prior to 9.5.1 that allows SQL injection through the "Clone" feature.

The Impact of CVE-2020-15108

CVSS Base Score: 7.1 (High)
Severity: High
Confidentiality Impact: High
Integrity Impact: Low
Privileges Required: Low
Attack Vector: Network
Attack Complexity: Low
User Interaction: None
Scope: Unchanged
Availability Impact: None

Technical Details of CVE-2020-15108

This section provides more technical insights into the vulnerability.

Vulnerability Description

The vulnerability allows attackers to perform SQL injection attacks via the "Clone" feature in glpi.

Affected Systems and Versions

Affected Product: glpi
Vendor: glpi-project
Vulnerable Versions: < 9.5.1

Exploitation Mechanism

The vulnerability can be exploited by injecting malicious SQL commands through the "Clone" feature in glpi.

Mitigation and Prevention

Protecting systems from this vulnerability is crucial.

Immediate Steps to Take

Upgrade glpi to version 9.5.1 or later to mitigate the SQL injection risk.
Monitor for any unusual activities that might indicate exploitation.

Long-Term Security Practices

Regularly update software to the latest versions to patch known vulnerabilities.
Implement secure coding practices to prevent SQL injection and other common web application vulnerabilities.

Patching and Updates

Apply security patches provided by glpi-project promptly to address this vulnerability.