CVE-2020-5248

Publication date 12 May 2020

Last updated 26 August 2025

Ubuntu priority

Medium

Why this priority?

Cvss 3 Severity Score

7.2 · High

Score breakdown

GLPI before before version 9.4.6 has a vulnerability involving a default encryption key. GLPIKEY is public and is used on every instance. This means anyone can decrypt sensitive data stored using this key. It is possible to change the key before installing GLPI. But on existing instances, data must be reencrypted with the new key. Problem is we can not know which columns or rows in the database are using that; espcially from plugins. Changing the key without updating data would lend in bad password sent from glpi; but storing them again from the UI will work.

Status

Package Ubuntu Release Status
glpi 25.04 plucky Not in release
24.10 oracular Not in release
24.04 LTS noble Not in release
23.10 mantic Not in release
23.04 lunar Not in release
22.10 kinetic Not in release
22.04 LTS jammy Not in release
21.10 impish Not in release
21.04 hirsute Not in release
20.10 groovy Not in release
20.04 LTS focal Not in release
19.10 eoan Not in release
18.04 LTS bionic Not in release
16.04 LTS xenial
Vulnerable
14.04 LTS trusty Not in release

Severity score breakdown

Parameter Value
Base score 7.2 · High
Attack vector Local
Attack complexity High
Privileges required High
User interaction None
Scope Changed
Confidentiality High
Integrity impact High
Availability impact None
Vector CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:N