by Kastro
Paper/Archive/CVE-2021-43778

CVE-2021-43778

pluginsGLPI barcode — Path traversal in GLPI barcode plugin

EPSS 53%CVSS 9.1
critical.is priorityof 100
47
CVSS 9.1 (CNA)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 99.0.990 × 2019.8No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

Barcode is a GLPI plugin for printing barcodes and QR codes. GLPI instances version 2.x prior to version 2.6.1 with the barcode plugin installed are vulnerable to a path traversal vulnerability. This issue was patched in version 2.6.1. As a workaround, delete the `front/send.php` file.

Affected

ProductAffectedFixed inSource
barcode>= 2.0.0, < 2.6.1–CNA

Scores by source

GitHub_M (CNA)9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

References

refgithub.com/pluginsGLPI/barcode/security/advisories/GHSA-2pjh-h828-wcw9refgithub.com/pluginsGLPI/barcode/commit/428c3d9adfb446e8492b1c2b7affb3d34072ff46refgithub.com/hansmach1ne/MyExploits/tree/main/Path%20Traversal%20in%20GLPI%20Barcode%20pluginrefgithub.com/pluginsGLPI/barcode/releases/tag/2.6.1refgithub.com/hansmach1ne/CVE-portfolio/tree/main/CVE-2021-43778