Forum GLPI-Project

francois-teclib

Expert GLPI

From: TECLIB

Registered: 2006-11-05

Posts: 74

Website

GLPI 9.5.13

This is a security release, upgrading is recommended

Below, you'll find a short list of key points of this release:

• [SECURITY - High] Account takeover by authenticated user (CVE-2023-28632).

• [SECURITY - High] SQL injection through dynamic reports (CVE-2023-28838).

• [SECURITY - Moderate] Stored XSS through dashboard administration (CVE-2023-28852).

• [SECURITY - Moderate] Stored XSS on external links (CVE-2023-28636).

• [SECURITY - Moderate] Reflected XSS in search pages (CVE-2023-28639).

• [SECURITY - Moderate] Privilege Escalation from technician to super-admin (CVE-2023-28634).

• [SECURITY - Low] Blind Server-Side Request Forgery (SSRF) in RSS feeds (CVE-2023-28633).

---

Besoin d'un support professionnel pour GLPI ? Pensez à GLPI Network ! https://glpi-project.org/fr/tarifs/

Connaissez-vous l'offre Cloud maintenue et supportée par l'équipe qui édite GLPI ?
Vous pouvez tester gratuitement pendant 45 jours ! https://glpi-network.cloud (ou plus si besoin)