CVE-2020-11031CWE-327

Insecure encryption algorithm in GLPI

High · published September 23, 2020

CVSS v3.1
7.8
EPSS
0%
Percentile
24.5
In the wild
Unconfirmed
What it is

In GLPI before version 9.5.0, the encryption algorithm used is insecure. The security of the data encrypted relies on the password used, if a user sets a weak/predictable password, an attacker could decrypt data. This is fixed in version 9.5.0 by using a more secure encryption library. The library chosen is sodium.

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00327 · 24.5th percentile
Weakness
CWE-327 · Use of a Broken or Risky Cryptographic Algorithm
Published
2020-09-23T15:20Z
EPSS history
Timeline
  • 23 SEP 15:20Z
    Insecure encryption algorithm in GLPI
    cvelistv5