Skip to content

9.5.13
Compare
Choose a tag to compare
@cedric-anne cedric-anne released this 05 Apr 13:09
· 4411 commits to 10.0/bugfixes since this release
9.5.13
d110d2b

Download it

This release fixes several security issues that have been recently discovered. Update is recommended!

You can download the GLPI 9.5.13 archive on GitHub.

You will find below the list of security issues fixed in this bugfixes version:

  • [SECURITY - High] Account takeover by authenticated user (CVE-2023-28632).
  • [SECURITY - High] SQL injection through dynamic reports (CVE-2023-28838).
  • [SECURITY - Moderate] Stored XSS through dashboard administration (CVE-2023-28852).
  • [SECURITY - Moderate] Stored XSS on external links (CVE-2023-28636).
  • [SECURITY - Moderate] Reflected XSS in search pages (CVE-2023-28639).
  • [SECURITY - Moderate] Privilege Escalation from technician to super-admin (CVE-2023-28634).
  • [SECURITY - Low] Blind Server-Side Request Forgery (SSRF) in RSS feeds (CVE-2023-28633).

Regards.

Assets 3