CVE-2020-11032 — SQL injection on addme_observer and addme_assign in GLPI

CVE-2020-11032

SQL injection on addme_observer and addme_assign in GLPI PUBLISHED

Description (CNA)

In GLPI before version 9.4.6, there is a SQL injection vulnerability for all helpdesk instances. Exploiting this vulnerability requires a technician account. This is fixed in version 9.4.6.

Affected (CNA)

Vendor / product	Versions
glpi-project / GLPI	affected < 9.4.6

CWE

CWE-89

References

https://github.com/glpi-project/glpi/security/advisories/GHSA-344w-34h9-wwhh

ADP enrichment

CVE

No English description supplied.

https://github.com/glpi-project/glpi/security/advisories/GHSA-344w-34h9-wwhh