What is CVE-2020-11035?

CVE-2020-11035 is a high-severity vulnerability in Glpi-Project Glpi, classified under Use of a Broken or Risky Cryptographic Algorithm. CVSS score: 7.5/10. Published 2020-05-05.

How severe is CVE-2020-11035?

High severity. CVSS v3 base score is 7.5 out of 10.

Vulnerability in Glpi-Project Glpi

CVE-2020-11035

In GLPI after version 0.83.3 and before version 9.4.6, the CSRF tokens are generated using an insecure algorithm. The implementation uses rand and uniqid and MD5 which does not provide secure values. This is fixed in version 9.4.6.

Vulnerability class: POODLE (CVE-2014-3566)

EPSS: 0.008 (52.3th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:N.

Affected products

Glpi-project Glpi — versions > 0.83.3, < 9.4.6
Fedoraproject Fedora — versions 31, 32

Weakness classification (CWE)

CWE-327 — Use of a Broken or Risky Cryptographic Algorithm

References

security-advisories@github.com (Technical Description, x_refsource_CONFIRM)
security-advisories@github.com (x_refsource_FEDORA, vendor-advisory)
security-advisories@github.com (x_refsource_FEDORA, vendor-advisory)

Frequently asked questions

What is CVE-2020-11035?: CVE-2020-11035 is a high-severity vulnerability in Glpi-Project Glpi, classified under Use of a Broken or Risky Cryptographic Algorithm. CVSS score: 7.5/10. Published 2020-05-05.
How severe is CVE-2020-11035?: High severity. CVSS v3 base score is 7.5 out of 10.