We are notifying the GLPI community of several security vulnerabilities identified in a number of community plugins. Updates are available and should be deployed promptly on all affected instances.
Affected Plugins and Vulnerabilities
The vulnerabilities identified cover a range of severity levels, including a critical Remote Code Execution (RCE) flaw in GenericObject (CVSS 8.9), multiple SQL injection and Cross-Site Scripting issues across several plugins, and access control malfunctions in Escalade, Credit, and Glpinventory.
Recommendations
We strongly recommend planning and deploying updates for all affected plugins as soon as possible on your GLPI instances, in order to maintain an optimal level of security and reduce the risk of exploitation.
Priority should be given to GenericObject (CVSS 8.9 – Critical), as it exposes instances to remote code execution.
GLPI Network Cloud Platforms
All fixes related to the plugins listed above have already been deployed on GLPI Network Cloud Public and GLPI Network Cloud Private platforms. No action is required for instances hosted in our managed environments.
Should you require technical assistance or additional information, please contact us.
