[oss-security] CVE Request -- GLPI -- Properly blacklist some sensitive fields

From: Jan Lieskovsky <jlieskov_at_nospam>
Date: Mon Jul 25 2011 - 12:52:42 GMT
To: "Steven M. Christey" <coley@linus.mitre.org>

Hello Josh, Steve, vendors,

it was found that GLPI, the Information Resource-Manager with an
additional Administration-Interface, did not properly blacklist certain
sensitive variables (like GLPI username and password). A remote attacker
could use this flaw to obtain access to plaintext form of these values
via specially-crafted HTTP POST request.

References:
[1] http://www.glpi-project.org/spip.php?page=annonce&id_breve=237&lang=en
[2] https://forge.indepnet.net/projects/glpi/versions/605
[3] https://forge.indepnet.net/issues/3017

Could you allocate a CVE id for this?

Thank you && Regards, Jan.
-- Jan iankko Lieskovsky / Red Hat Security Response Team

This message: [ Message body ]
Next message: Vasiliy Kulikov: "Re: [oss-security] CVE Request -- rpm -- Fails to remove the SUID/SGID bits on package upgrade (RH BZ#598775)"
Previous message: Moritz MÃ¼hlenhoff: "Re: [oss-security] Squirrelmail CVE duplicates"
Next in thread: Josh Bressers: "Re: [oss-security] CVE Request -- GLPI -- Properly blacklist some sensitive fields"
Reply: Josh Bressers: "Re: [oss-security] CVE Request -- GLPI -- Properly blacklist some sensitive fields"

Contemporary messages sorted: [ By Date ] [ By Thread ] [ By Subject ] [ By Author ]