NVD

Id
40945  
Name
CVE-2013-5696  
Description
inc/central.class.php in GLPI before 0.84.2 does not attempt to make install/install.php unavailable after an installation is completed, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks, and (1) perform a SQL injection via an Etape_4 action or (2) execute arbitrary PHP code via an update_1 action.  
Reject
 
CVSS Version
2  
CVSS Score
6.8  
Severity
Medium  
CVSS Base Score
6.8  
CVSS Impact Subscore
6.4  
CVSS Exploit Subscore
8.6  
CVSS Vector
(AV:N/AC:M/Au:N/C:P/I:P/A:P)  
Pub Date
2017-01-18  
Published
2013-09-22  
Modified Date
2013-09-23  
Seq
2013-5696  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
206954 40945 CVE-2013-5696 http://www.glpi-project.org/spip.php?page=annonce&id_breve=308  View
206955 40945 CVE-2013-5696 https://forge.indepnet.net/issues/4480  View
206956 40945 CVE-2013-5696 https://forge.indepnet.net/projects/glpi/repository/revisions/21753  View
206957 40945 CVE-2013-5696 https://forge.indepnet.net/projects/glpi/repository/revisions/21753/diff/branches/0.84-bugfixes/inc/central.class.php  View
206958 40945 CVE-2013-5696 https://www.navixia.com/blog/entry/navixia-finds-critical-vulnerabilities-in-glpi-cve-2013-5696.html  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
22680 JVNDB-2013-004255 GLPI の inc/central.class.php におけるクロスサイトリクエストフォージェリ攻撃を実行される脆弱性 GLPI の inc/central.class.php は、インストール完了後に install/install.php を利用できないようにしないため、クロスサイトリクエストフォージェリ (CSRF) 攻撃を実行され、(1) SQL インジェクションまたは (2) 任意の PHP コードを実行される脆弱性が存在します。 CVE-2013-5696 65638 CVE-2013-5696 40945 6.8 http://jvndb.jvn.jp/ja/contents/2013/JVNDB-2013-004255.html 2013-09-12 2013-09-25 View