CVE-2021-39209 — Bypassable CSRF protection
GLPI is a free Asset and IT management software package. In versions prior to 9.5.6, a user who is logged in to GLPI can bypass Cross-Site Request Forgery (CSRF) protection in m…
Published: 2021-09-15 · CVSS: 8.8 · CVSS 3.1
GLPI is a free Asset and IT management software package. In versions prior to 9.5.6, a user who is logged in to GLPI can bypass Cross-Site Request Forgery (CSRF) protection in many places. This could allow a malicious actor to perform many actions on GLPI. This issue is fixed in version 9.5.6. There are no workarounds aside from upgrading.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7