CVE-2014-8360

Priority
Description
Directory traversal vulnerability in inc/autoload.function.php in GLPI
before 0.84.8 allows remote attackers to include and execute arbitrary
local files via a .._ (dot dot underscore) in an item type to the
getItemForItemtype, as demonstrated by the itemtype parameter in
ajax/common.tabs.php.
Package
Source: glpi (LP Ubuntu Debian)
Upstream:needs-triage
Ubuntu 12.04 ESM (Precise Pangolin):DNE (precise was needed)
Ubuntu 14.04 LTS (Trusty Tahr):needed
Ubuntu 16.04 LTS (Xenial Xerus):not-affected (0.84.8+dfsg.1-1)
Ubuntu 18.04 LTS (Bionic Beaver):DNE
Ubuntu 18.10 (Cosmic Cuttlefish):DNE
Ubuntu 19.04 (Disco Dingo):DNE
Ubuntu 19.10 (Eoan):DNE
More Information

Updated: 2019-04-22 21:16:24 UTC (commit 750f6738e68600bdf0b7c7ef543b49378c330e4e)