CVE-2020-11034CWE-185CWE-601

bypass of manageRedirect in GLPI

Medium · published May 5, 2020

CVSS v3.1
6.1
EPSS
8%
Percentile
94.5
In the wild
Unconfirmed
What it is

In GLPI before version 9.4.6, there is a vulnerability that allows bypassing the open redirect protection based which is based on a regexp. This is fixed in version 9.4.6.

The record
Technical detail
CVSS v3.1
6.1 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.07574 · 94.5th percentile
Weaknesses
CWE-185 · Incorrect Regular Expression; CWE-601 · URL Redirection to Untrusted Site ('Open Redirect')
Published
2020-05-05T21:20Z
EPSS history
Timeline
  • 05 MAY 21:20Z
    bypass of manageRedirect in GLPI
    cvelistv5