{"id":"CVE-2020-11035","published":"2020-05-05T21:30:12Z","modified":"2024-08-04T11:21:14Z","title":"weak CSRF tokens in GLPI","vendor":"glpi-project","product":"GLPI","tier":"core","eol":null,"affectedVersions":[{"vendor":"glpi-project","product":"GLPI","versions":["> 0.83.3, < 9.4.6"]}],"description":{"text":"In GLPI after version 0.83.3 and before version 9.4.6, the CSRF tokens are generated using an insecure algorithm. The implementation uses rand and uniqid and MD5 which does not provide secure values. This is fixed in version 9.4.6.","provenance":"source","from":"CVE.org"},"summary":null,"cvss":{"score":7.5,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:N","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.00898,"percentile":0.5948,"date":"2026-10-28","provenance":"source"},"kev":null,"vulncheckKev":null,"exploited":false,"otx":{"pulseCount":0,"pulses":[],"provenance":"machine"},"cwes":[{"id":"CWE-327","name":"Use of a Broken or Risky Cryptographic Algorithm"}],"references":[{"url":"https://github.com/glpi-project/glpi/security/advisories/GHSA-w7q8-58qp-vmpf","tags":["x_refsource_CONFIRM"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Q4BG2UTINBVV7MTJRXKBQ26GV2UINA6L/","tags":["vendor-advisory","x_refsource_FEDORA"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5WQMONZRWLWOXMHMYWR7A5Q5JJERPMVC/","tags":["vendor-advisory","x_refsource_FEDORA"]}],"techniques":[{"id":"T1110","name":"Brute Force","tactics":["credential-access"],"provenance":"source","basis":"ctid-cve","bases":["ctid-cve"],"basisDetail":"CTID attack_to_cve (Phase 2)","mappingType":"exploitation_technique","evidence":[],"confidence":"high"},{"id":"T1040","name":"Network Sniffing","tactics":["credential-access","discovery"],"provenance":"source","basis":"ctid-cve","bases":["ctid-cve"],"basisDetail":"CTID attack_to_cve (Phase 2)","mappingType":"primary_impact","evidence":[],"confidence":"high"},{"id":"T1078","name":"Valid Accounts","tactics":["initial-access","persistence","privilege-escalation","stealth"],"provenance":"source","basis":"ctid-cve","bases":["ctid-cve"],"basisDetail":"CTID attack_to_cve (Phase 2)","mappingType":"primary_impact","evidence":[],"confidence":"high"},{"id":"T1557","name":"Adversary-in-the-Middle","tactics":["collection","credential-access"],"provenance":"source","basis":"ctid-cve","bases":["ctid-cve"],"basisDetail":"CTID attack_to_cve (Phase 2)","mappingType":"primary_impact","evidence":[],"confidence":"high"}],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2020-3420","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-3420","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":null,"exploitRefs":[],"flow":[{"stage":"exploitation","techniques":["T1110"],"provenance":"source"},{"stage":"primary","techniques":["T1078","T1040","T1557"],"provenance":"source"}],"timeline":[{"date":"2020-05-05","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2020-11035","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":null},"priority":{"score":17.1,"factors":[{"name":"In a KEV catalog","points":0.0,"detail":"not listed"},{"name":"Recent KEV listing","points":0.0,"detail":"not listed"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":11.9,"detail":"percentile 0.5948"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":0.0,"detail":"none found"},{"name":"Mentioned in OTX pulses","points":0.0,"detail":"0 pulses"},{"name":"CVSS severity","points":5.25,"detail":"base score 7.5"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}