CVE-2020-11031: 
GLPI vulnerability analysis and mitigation

CVE-2020-11031 affects GLPI versions before 9.5.0, where the encryption algorithm used for data protection was found to be insecure. The vulnerability was discovered and disclosed in July 2020, impacting all versions of GLPI prior to version 9.5.0. The security of encrypted data heavily relied on user-chosen passwords, making it susceptible to decryption if weak or predictable passwords were used (GitHub Advisory).

The vulnerability stems from the implementation of a weak encryption algorithm that relied primarily on user-defined passwords for security. The issue was assigned a CVSS v3.1 base score of 7.5 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. The vulnerability is classified under CWE-327 (Use of a Broken or Risky Cryptographic Algorithm) (NVD).

If exploited, this vulnerability could allow attackers to decrypt sensitive data stored in the GLPI system if weak or predictable passwords were used. The primary risk is unauthorized access to encrypted information, potentially compromising confidential data stored within the GLPI installation (GitHub Advisory).

The vulnerability is exploitable when users set weak or predictable passwords, as the security of the encryption relied heavily on the strength of these passwords. No specific instances of exploitation in the wild have been publicly reported (GitHub Advisory).

The vulnerability was fixed in GLPI version 9.5.0 by implementing a more secure encryption library called sodium. The solution includes both native PHP extension support and a PHP polyfill library, making the security improvement accessible without requiring the native extension. Users are strongly advised to upgrade to version 9.5.0 or later (GitHub Advisory).