CVE-2020-11031
High
Description
In GLPI before version 9.5.0, the encryption algorithm used is insecure. The security of the data encrypted relies on the password used, if a user sets a weak/predictable password, an attacker could decrypt data. This is fixed in version 9.5.0 by using a more secure encryption library. The library chosen is sodium.
SeverityHigh
CVSS7.8
Exploit probability—
Product
Glpi
PublishedSep 23, 2020
First seenSep 23, 2020
Weakness typeCWE-327CWE-327
How to fix
Update
- glpi-project glpi9.5.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| glpi-project glpi | v < 9.5.0 | 9.5.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.