CVE-2020-27663: 
GLPI vulnerability analysis and mitigation

CVE-2020-27663 affects GLPI versions before 9.5.3, specifically in the ajax/getDropdownValue.php component. The vulnerability was discovered and disclosed on November 25, 2020. It is an Insecure Direct Object Reference (IDOR) vulnerability that affects the GLPI project's core functionality (GitHub Advisory).

The vulnerability has been assigned a CVSS v3.1 base score of 4.3 (MEDIUM) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. The issue is classified as CWE-639 (Authorization Bypass Through User-Controlled Key). The vulnerability exists in the ajax/getDropdownValue.php file, which fails to properly validate access controls for itemType parameters (NVD).

The vulnerability allows an authenticated attacker with minimal privileges (even a self-service profile) to read data from any itemType in GLPI, including Tickets, Users, and other sensitive information. However, the exposure is limited to id and name fields of the objects (GitHub Advisory).

The vulnerability requires authentication but has low complexity to exploit. An attacker needs only a basic user account (such as self-service profile) to exploit this vulnerability. The attack can be performed remotely through the web interface (GitHub Advisory).

The vulnerability has been patched in GLPI version 9.5.3. Users are advised to upgrade to this version or later to mitigate the risk. The fix was implemented through commit e0d6a24 (GitHub Advisory).