UpHeron
All vulnerabilities

Servers and applications

CVE-2020-27663

In GLPI before 9.5.3, ajax/getDropdownValue.php has an Insecure Direct Object Reference (IDOR) vulnerability that allows an attacker to read data from any itemType (e.g., Ticket, Users, etc.).

Severity
Medium 4.3
Published
26 Nov 2020
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
9.5.3
Sources
NVD

Affected software

SoftwareAffected versions
GLPIServers and applications · cpe:a:glpi-project:glpi
  • Every version before 9.5.3

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2020-27663
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2020-27663