CVE-2021-21325

MEDIUM

GLPI < 9.5.4 - Authenticated Stored Cross-Site Scripting via Budget Type Input

Title source: llm
STIX 2.1

Description

GLPI is an open-source asset and IT management software package that provides ITIL Service Desk features, licenses tracking and software auditing. In GLPI before version 9.5.4 a new budget type can be defined by user. This input is not correctly filtered. This results in a cross-site scripting attack. To exploit this endpoint attacker need to be authenticated. This is fixed in version 9.5.4.

References (2)

Core 2
Core References
Release Notes, Third Party Advisory x_refsource_misc
https://github.com/glpi-project/glpi/releases/tag/9.5.4

Scores

CVSS v3 6.2
EPSS 0.0051
EPSS Percentile 66.5%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:N/I:H/A:N

Details

CWE
CWE-79
Status published
Products (1)
glpi-project/glpi < 9.5.4
Published Mar 08, 2021
Tracked Since Feb 18, 2026