CVE Feed

    Dashboard / CVE / CVE-2020-5248

    CVE-2020-5248

    GLPI before before version 9.4.6 has a vulnerability involving a default encryption key. GLPIKEY is public and is used on every instance. This means anyone can decrypt sensitive data stored using this key. It is possible to change the key before installing GLPI. But on existing instances, data must be reencrypted with the new key. Problem is we can not know which columns or rows in the database are using that; espcially from plugins. Changing the key without updating data would lend in bad password sent from glpi; but storing them again from the UI will work.

    Published:May 12, 2020
    Last Modified:Nov 21, 2024
    EPS:May 12, 2020
    EPSS Score:0.02836
    CVSS Score:7.2

    Affected Products

    Vendor
    Glpi-project
    Product
    Glpi

    Exploits

    https://github.com/Mkway/CVE-2020-5248https://github.com/venomnis/CVE-2020-5248

    Common Weakness Enumeration

    CWE-798 Use of Hard-coded Credentials

    Related CVEs

    CVE-2026-13490 (CVSS 6.3) — A security vulnerability has been detected in glpi-project glpi 11.0.5/11.0.6/11.0.7. This affects the functio…
    CVE-2026-42321 (CVSS 8.4) — GLPI is a free asset and IT management software package. Starting in version 10.0.4 and prior to version 10.0.…
    CVE-2026-42320 (CVSS 5.9) — GLPI is a free asset and IT management software package. Starting in version 0.50 and prior to versions 10.0.2…
    CVE-2026-42318 (CVSS 7) — GLPI is a free asset and IT management software package. Starting in version 9.5.0 and prior to versions 10.0.…
    CVE-2026-42317 (CVSS 7) — GLPI is a free asset and IT management software package. Starting in version 0.78 and prior to versions 10.0.2…
    CVE-2026-44281 (CVSS 7) — GLPI is a free asset and IT management software package. Starting in version 0.78 and prior to versions 10.0.2…
    CVE-2026-40108 (CVSS 7.1) — GLPI is a free asset and IT management software package. In versions 11.0.0 through 11.0.6, a technician can s…
    CVE-2026-5385 (CVSS 8.4) — An unauthenticated user with write access to the knowledge base can store an XSS payload in a knowledge base i…
    CVE-2026-32312 (CVSS 5.1) — GLPI is a free asset and IT management software package. In versions 11.0.0 through 11.0.6, an authenticated u…
    CVE-2026-29047 (CVSS 7.2) — GLPI is a free asset and IT management software package. From 10.0.0 to before 10.0.24 and 11.0.6, an authenti…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High