CVE-2020-11060

Name	CVE-2020-11060
Description	In GLPI before 9.4.6, an attacker can execute system commands by abusing the backup functionality. Theoretically, this vulnerability can be exploited by an attacker without a valid account by using a CSRF. Due to the difficulty of the exploitation, the attack is only conceivable by an account having Maintenance privileges and the right to add WIFI networks. This is fixed in version 9.4.6.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
glpi (PTS)	jessie	0.84.8+dfsg.1-1	vulnerable

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
glpi	source	(unstable)	(unfixed)	unimportant

Notes

https://github.com/glpi-project/glpi/security/advisories/GHSA-cvvq-3fww-5v6f
https://github.com/glpi-project/glpi/commit/ad748d59c94da177a3ed25111c453902396f320c
Only supported behind an authenticated HTTP zone