CVE-2020-11062: 
GLPI vulnerability analysis and mitigation

A Moderate severity vulnerability (CVE-2020-11062) was discovered in GLPI project affecting versions greater than 0.68.1. The vulnerability was disclosed on May 11, 2020, and was patched in version 9.4.6. This security issue involves multiple Reflexive Cross-Site Scripting (XSS) vulnerabilities in Dropdown endpoints (GitHub Advisory).

The vulnerability stems from an invalid Content-Type header in multiple dropdown-related PHP files. The affected files were setting the Content-Type header to 'text/html' instead of the correct 'application/json' for JSON responses. This misconfiguration was present in several files including autocompletion.php, getDropdownConnect.php, getDropdownFindNum.php, getDropdownNetpoint.php, getDropdownNumber.php, getDropdownUsers.php, and getDropdownValue.php (GLPI Commit).

The vulnerability allows attackers to perform Reflexive Cross-Site Scripting attacks through the dropdown menu endpoints. This type of attack could potentially lead to unauthorized access to user data or execution of malicious scripts in the context of the user's browser (GitHub Advisory).

The vulnerability was classified as CWE-79 (Cross-site Scripting) according to the Common Weakness Enumeration system (NVD Report).

The vulnerability was patched in GLPI version 9.4.6. The fix involved changing the Content-Type header from 'text/html' to 'application/json' in all affected dropdown-related PHP files (GLPI Commit).