CVE-2020-11060: 
GLPI vulnerability analysis and mitigation

CVE-2020-11060 is a vulnerability discovered in GLPI before version 9.4.6 that allows system command execution through the backup functionality. The vulnerability was disclosed on May 12, 2020, affecting the GLPI project's asset and IT management software. The issue primarily impacts systems running GLPI versions prior to 9.4.6, where an attacker could potentially execute arbitrary system commands (GHSA Advisory).

The vulnerability is classified as a Remote Code Execution (RCE) vulnerability with a CVSS v3.1 Base Score of 8.8 (HIGH) according to NVD's assessment (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). GitHub's assessment gives it a slightly lower score of 7.4 (HIGH) with vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L. The vulnerability involves the abuse of backup functionality, which could potentially be exploited through a Cross-Site Request Forgery (CSRF) attack (NVD).

If successfully exploited, this vulnerability allows attackers to execute system commands on the affected GLPI installation. While theoretically exploitable without authentication through CSRF, the practical impact is primarily limited to accounts with Maintenance privileges and the right to add WIFI networks (GHSA Advisory).

The primary mitigation is to upgrade to GLPI version 9.4.6 or later, which contains the fix for this vulnerability. As a temporary workaround, administrators can delete the front/backup.php file to prevent exploitation. The fix was implemented through commit ad748d59c94da177a3ed25111c453902396f320c which removed the vulnerable backup functionality (GHSA Advisory).