CVE-2018-7563 | BDVDB-2026-97708 Detail

Description#

An issue was discovered in GLPI through 9.2.1. The application is affected by XSS in the query string to front/preference.php. An attacker is able to create a malicious URL that, if opened by an authenticated user with debug privilege, will execute JavaScript code supplied by the attacker. The attacker-supplied code can perform a wide variety of actions, such as stealing the victim's session token or login credentials, performing arbitrary actions on the victim's behalf, and logging their keystrokes.

Impact#

Weaknesses#

References#

Exploit#

History#

1. Version 12018-03-12Record published in the CVE List.
2. Version 22024-08-05Most recent update recorded in the CVE List.