CVE:CVE-2012-4002
CNNVD:CNNVD-201207-174
GLPI是Indepnet协会维护的一款开源的IT资源管理套件。该套件包含设备状态管理、资产清单存储、管理流程和工作日志管理等功能。
GLPI 早期版本至0.83.3版本中存在跨站请求伪造漏洞，该漏洞源于对用户提供的输入未经正确验证。攻击者可利用该漏洞在受影响站点上下文中不知情用户浏览器中执行任意脚本代码，窃取基于cookie的认证证书，进而泄露或修改敏感信息，或执行未授权操作，也可能存在其他攻击。
solution:Upgrade glpi-project glpi to a higher version than 0.83.2,0.5,0.5:rc1,0.5:rc2,0.6,0.6:rc1,0.6:rc2,0.6:rc3,0.20,0.21,0.30,0.31,0.40,0.41,0.42,0.51,0.51a,0.65,0.65:rc1,0.65:rc2,0.68,0.68:rc1,0.68:rc2,0.68:rc3,0.68.1,0.68.2,0.68.3,0.70,0.70:rc1,0.70:rc2,0.70:rc3,0.70.1,0.70.2,0.71,0.71.1,0.71.1:rc1,0.71.1:rc2,0.71.1:rc3,0.71.2,0.71.3,0.71.4,0.71.5,0.71.6,0.72,0.72:rc1,0.72:rc2,0.72:rc3,0.72.1,0.72.2,0.72.3,0.72.4,0.78,0.78.1,0.78.2,0.78.3,0.78.4,0.78.5,0.80,0.80.1,0.80.2,0.80.3,0.80.4,0.80.5,0.80.6,0.80.7,0.80.61,0.83,0.83.1,and avoid the version (,0.83.2],0.5,0.5:rc1,0.5:rc2,0.6,0.6:rc1,0.6:rc2,0.6:rc3,0.20,0.21,0.30,0.31,0.40,0.41,0.42,0.51,0.51a,0.65,0.65:rc1,0.65:rc2,0.68,0.68:rc1,0.68:rc2,0.68:rc3,0.68.1,0.68.2,0.68.3,0.70,0.70:rc1,0.70:rc2,0.70:rc3,0.70.1,0.70.2,0.71,0.71.1,0.71.1:rc1,0.71.1:rc2,0.71.1:rc3,0.71.2,0.71.3,0.71.4,0.71.5,0.71.6,0.72,0.72:rc1,0.72:rc2,0.72:rc3,0.72.1,0.72.2,0.72.3,0.72.4,0.78,0.78.1,0.78.2,0.78.3,0.78.4,0.78.5,0.80,0.80.1,0.80.2,0.80.3,0.80.4,0.80.5,0.80.6,0.80.7,0.80.61,0.83,0.83.1