Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1000 CNY

100.0%
Buy Us a Coffee
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2020-5248
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Public GLPIKEY can be used to decrypt any data in GLPI
Source: NVD (National Vulnerability Database)
Vulnerability Description
GLPI before before version 9.4.6 has a vulnerability involving a default encryption key. GLPIKEY is public and is used on every instance. This means anyone can decrypt sensitive data stored using this key. It is possible to change the key before installing GLPI. But on existing instances, data must be reencrypted with the new key. Problem is we can not know which columns or rows in the database are using that; espcially from plugins. Changing the key without updating data would lend in bad password sent from glpi; but storing them again from the UI will work.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:N
Source: NVD (National Vulnerability Database)
Vulnerability Type
使用硬编码的凭证
Source: NVD (National Vulnerability Database)
Vulnerability Title
Teclib GLPI 信任管理问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Teclib GLPI是法国Teclib公司的一套开源的IT资产管理套件。该套件包含设备状态管理、资产清单存储、管理流程和工作日志管理等功能。 Teclib GLPI 9.4.6之前版本中存在信任管理问题漏洞。该漏洞源于网络系统或产品中缺乏有效的信任管理机制。攻击者可利用默认密码或者硬编码密码、硬编码证书等攻击受影响组件。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
VendorProductAffected VersionsCPESubscribe
glpi-projectglpi < 9.4.6 -
II. Public POCs for CVE-2020-5248
#POC DescriptionSource LinkShenlong Link
1Proof of Concept (PoC) for CVE-2020-5248.https://github.com/indevi0us/CVE-2020-5248POC Details
2CVE-2020-5248https://github.com/Mkway/CVE-2020-5248POC Details
3Proof of Concept (PoC) for CVE-2020-5248.https://github.com/venomnis/CVE-2020-5248POC Details
AI-Generated POCPremium

No public POC found.

Login to generate AI POC
III. Intelligence Information for CVE-2020-5248
Please Login to view more intelligence information
IV. Related Vulnerabilities
Same product: glpi
Same vendor: glpi-project
Same weakness: CWE-798
V. Comments for CVE-2020-5248

No comments yet

Leave a comment