CVE-2011-2720
Summary
| CVE | CVE-2011-2720 |
|---|---|
| State | PUBLISHED |
| Assigner | redhat |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2011-08-05 21:55:06 UTC |
| Updated | 2026-04-29 01:13:23 UTC |
| Description | The autocompletion functionality in GLPI before 0.80.2 does not blacklist certain username and password fields, which allows remote attackers to obtain sensitive information via a crafted POST request. |
Risk And Classification
CVSS v2.0 Breakdown
Access Vector
NetworkAccess Complexity
LowAuthentication
NoneConfidentiality
PartialIntegrity
NoneAvailability
NoneAV:N/AC:L/Au:N/C:P/I:N/A:N
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Glpi-project | Glpi | 0.42 | All | All | All |
| Application | Glpi-project | Glpi | 0.5 | All | All | All |
| Application | Glpi-project | Glpi | 0.5 | rc1 | All | All |
| Application | Glpi-project | Glpi | 0.5 | rc2 | All | All |
| Application | Glpi-project | Glpi | 0.51 | All | All | All |
| Application | Glpi-project | Glpi | 0.51a | All | All | All |
| Application | Glpi-project | Glpi | 0.6 | All | All | All |
| Application | Glpi-project | Glpi | 0.6 | rc1 | All | All |
| Application | Glpi-project | Glpi | 0.6 | rc2 | All | All |
| Application | Glpi-project | Glpi | 0.6 | rc3 | All | All |
| Application | Glpi-project | Glpi | 0.65 | All | All | All |
| Application | Glpi-project | Glpi | 0.65 | rc1 | All | All |
| Application | Glpi-project | Glpi | 0.65 | rc2 | All | All |
| Application | Glpi-project | Glpi | 0.68 | All | All | All |
| Application | Glpi-project | Glpi | 0.68 | rc1 | All | All |
| Application | Glpi-project | Glpi | 0.68 | rc2 | All | All |
| Application | Glpi-project | Glpi | 0.68 | rc3 | All | All |
| Application | Glpi-project | Glpi | 0.68.1 | All | All | All |
| Application | Glpi-project | Glpi | 0.68.2 | All | All | All |
| Application | Glpi-project | Glpi | 0.68.3 | All | All | All |
| Application | Glpi-project | Glpi | 0.70 | All | All | All |
| Application | Glpi-project | Glpi | 0.70 | rc1 | All | All |
| Application | Glpi-project | Glpi | 0.70 | rc2 | All | All |
| Application | Glpi-project | Glpi | 0.70 | rc3 | All | All |
| Application | Glpi-project | Glpi | 0.70.1 | All | All | All |
| Application | Glpi-project | Glpi | 0.70.2 | All | All | All |
| Application | Glpi-project | Glpi | 0.71 | All | All | All |
| Application | Glpi-project | Glpi | 0.71.1 | All | All | All |
| Application | Glpi-project | Glpi | 0.71.1 | rc1 | All | All |
| Application | Glpi-project | Glpi | 0.71.1 | rc2 | All | All |
| Application | Glpi-project | Glpi | 0.71.1 | rc3 | All | All |
| Application | Glpi-project | Glpi | 0.71.2 | All | All | All |
| Application | Glpi-project | Glpi | 0.71.3 | All | All | All |
| Application | Glpi-project | Glpi | 0.71.4 | All | All | All |
| Application | Glpi-project | Glpi | 0.71.5 | All | All | All |
| Application | Glpi-project | Glpi | 0.71.6 | All | All | All |
| Application | Glpi-project | Glpi | 0.72 | All | All | All |
| Application | Glpi-project | Glpi | 0.72 | rc1 | All | All |
| Application | Glpi-project | Glpi | 0.72 | rc2 | All | All |
| Application | Glpi-project | Glpi | 0.72 | rc3 | All | All |
| Application | Glpi-project | Glpi | 0.72.1 | All | All | All |
| Application | Glpi-project | Glpi | 0.72.2 | All | All | All |
| Application | Glpi-project | Glpi | 0.72.3 | All | All | All |
| Application | Glpi-project | Glpi | 0.72.4 | All | All | All |
| Application | Glpi-project | Glpi | 0.78 | All | All | All |
| Application | Glpi-project | Glpi | 0.78.1 | All | All | All |
| Application | Glpi-project | Glpi | 0.78.2 | All | All | All |
| Application | Glpi-project | Glpi | 0.78.3 | All | All | All |
| Application | Glpi-project | Glpi | 0.78.4 | All | All | All |
| Application | Glpi-project | Glpi | 0.78.5 | All | All | All |
| Application | Glpi-project | Glpi | 0.80 | All | All | All |
| Application | Glpi-project | Glpi | All | All | All | All |
Vendor Declared Affected Products
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| GLPI Autocomplete Information Disclosure Security Issue - Secunia.com | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | Vendor Advisory |
| Support / Security / Advisories / / MDVSA-2012:014 | Mandriva | af854a3a-2127-422b-91ae-364da2661108 | www.mandriva.com | |
| 726185 – (CVE-2011-2720) CVE-2011-2720 glpi: does not properly blacklist certain sensitive variables, like username and password | af854a3a-2127-422b-91ae-364da2661108 | bugzilla.redhat.com | Patch |
| GLPI-PROJECT - 0.80.2 - Forge INDEPNET | af854a3a-2127-422b-91ae-364da2661108 | forge.indepnet.net | |
| oss-security - CVE Request -- GLPI -- Properly blacklist some sensitive fields | af854a3a-2127-422b-91ae-364da2661108 | www.openwall.com | Patch |
| forge.indepnet.net/projects/glpi/repository/revisions/14966 | af854a3a-2127-422b-91ae-364da2661108 | forge.indepnet.net | Patch |
| forge.indepnet.net/projects/glpi/repository/revisions/14960 | af854a3a-2127-422b-91ae-364da2661108 | forge.indepnet.net | Patch |
| GLPI Prior to 0.80.2 Information Disclosure Vulnerability | af854a3a-2127-422b-91ae-364da2661108 | www.securityfocus.com | |
| [SECURITY] Fedora 15 Update: glpi-0.78.5-2.svn14966.fc15 | af854a3a-2127-422b-91ae-364da2661108 | lists.fedoraproject.org | |
| GLPI-PROJECT - Bug #3017: Security fix on autocompletion - Forge INDEPNET | af854a3a-2127-422b-91ae-364da2661108 | forge.indepnet.net | |
| oss-security - Re: CVE Request -- GLPI -- Properly blacklist some sensitive fields | af854a3a-2127-422b-91ae-364da2661108 | www.openwall.com | Patch |
| forge.indepnet.net/projects/glpi/repository/revisions/14958 | af854a3a-2127-422b-91ae-364da2661108 | forge.indepnet.net | Patch |
| forge.indepnet.net/projects/glpi/repository/revisions/14954 | af854a3a-2127-422b-91ae-364da2661108 | forge.indepnet.net | Patch |
| forge.indepnet.net/projects/glpi/repository/revisions/14955 | af854a3a-2127-422b-91ae-364da2661108 | forge.indepnet.net | Patch |
| forge.indepnet.net/projects/glpi/repository/revisions/14957 | af854a3a-2127-422b-91ae-364da2661108 | forge.indepnet.net | Patch |
| Security Advisory SA45542 - Fedora update for glpi, glpi-data-injection, glpi-mass-ocs-import, and glpi-pdf - Secunia | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | |
| forge.indepnet.net/projects/glpi/repository/revisions/14956 | af854a3a-2127-422b-91ae-364da2661108 | forge.indepnet.net | Patch |
| forge.indepnet.net/projects/glpi/repository/revisions/14952 | af854a3a-2127-422b-91ae-364da2661108 | forge.indepnet.net | Patch |
| forge.indepnet.net/projects/glpi/repository/revisions/14951 | af854a3a-2127-422b-91ae-364da2661108 | forge.indepnet.net | Patch |
| [SECURITY] Fedora 14 Update: glpi-pdf-0.7.2-1.fc14 | af854a3a-2127-422b-91ae-364da2661108 | lists.fedoraproject.org | |
| www.glpi-project.org/spip.php | af854a3a-2127-422b-91ae-364da2661108 | www.glpi-project.org | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.