CWE Code: 79
Vulnerability Type: privilege_escalation
CVSS Score: 4.3
CWE Name:  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Summary: an issue was discovered in glpi through 9.2.1. the application is affected by xss in the query string to front/preference.php. an attacker is able to create a malicious url that, if opened by an authenticated user with debug privilege, will execute javascript code supplied by the attacker. the attacker-supplied code can perform a wide variety of actions, such as stealing the victim's session token or login credentials, performing arbitrary actions on the victim's behalf, and logging their keystrokes.
Access Authentication: NONE
Access Complexity: MEDIUM
Access Vector: NETWORK
Impact (C/I/A): NONE/PARTIAL/NONE
Published Date: 2018-03-12
Last Modified Date: 2018-04-11