Une nouvelle version de GLPI est disponible.

This release fixes several security issues that have been recently discovered. Update is recommended!

You can download the GLPI 10.0.8 archive on GitHub.

Vous trouverez ci-dessous la liste des problèmes de sécurité corrigés dans cette version corrective :

• [SECURITY - High] SQL injection via inventory agent request (CVE-2023-35924).
• [SECURITY - High] SQL injection through Computer Virtual Machine information (CVE-2023-36808).
• [SECURITY - High] Unauthorized access to Dashboard data (CVE-2023-35939).
• [SECURITY - High] Unauthenticated access to Dashboard data (CVE-2023-35940).
• [SECURITY - Moderate] Reflected XSS in search pages (CVE-2023-34244).
• [SECURITY - Moderate] Unauthorized access to knowledge base items (CVE-2023-34107).
• [SECURITY - Moderate] Unauthorized access to user data (CVE-2023-34106).

Also, here is a short list of main changes done in this version:

• [FEATURE] Improve mail grouping (#14296)
• [FEATURE] Add deleted status in item’s header (#14382)
• [FEATURE] Add option to control the display of dropdowns labels (#14472)
• [FEATURE] Permits to check DB schema from GLPI versions >= 0.80 (#14666)
• [FIX] Improve performance of plugins init (#14511)
• [FIX] Improve performance of kanban views (#14525, #14599, #14764)
• [FIX] Ldap issues with PHP versions >= 8.1 (#14561)
• [FIX] SLA waiting time duration (#14937)
• [FIX] Notification encoding for MS Outlook (#14959)
• A lot of fixes in native inventory

Le journal des modifications complet est disponible pour plus de détails.

Nous tenons à remercier toutes les personnes qui ont contribué à cette nouvelle version et tous ceux qui contribuent régulièrement au projet GLPI !

Cordialement.