Vulnerability CVE-2025-21627: Information
Description
GLPI is a free asset and IT management software package. In versions prior to 10.0.18, a malicious link can be crafted to perform a reflected XSS attack on the search page. If the anonymous ticket creation is enabled, this attack can be performed by an unauthenticated user. Version 10.0.18 contains a fix for the issue.
Severity: MEDIUM (6.1) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Fixed packages
Package name | Branch | Fixed in version | Version from repository | Errata ID | Task # | State |
|---|---|---|---|---|---|---|
| glpi | sisyphus | 10.0.18-alt1 | 10.0.18-alt1 | ALT-PU-2025-4052-1 | 377585 | Fixed |
| glpi | sisyphus_e2k | 10.0.18-alt1 | 10.0.18-alt1 | ALT-PU-2025-4342-1 | - | Fixed |
| glpi | sisyphus_riscv64 | 10.0.18-alt1 | 10.0.18-alt1 | ALT-PU-2025-4139-1 | - | Fixed |
| glpi | sisyphus_loongarch64 | 10.0.18-alt1 | 10.0.18-alt1 | ALT-PU-2025-4148-1 | - | Fixed |
| glpi | p11 | 10.0.18-alt1 | 10.0.18-alt1 | ALT-PU-2025-4115-2 | 377682 | Fixed |
References to Advisories, Solutions, and Tools
Hyperlink | Resource |
|---|---|
| https://github.com/glpi-project/glpi/security/advisories/GHSA-qm8p-jmj2-qfc2 |
|