CVE-2020-5248: 
GLPI vulnerability analysis and mitigation

CVE-2020-5248 is a vulnerability discovered in GLPI software affecting all versions prior to 9.4.6. The vulnerability involves the use of a default encryption key (GLPIKEY) that is public and identical across all GLPI instances, compromising the security of sensitive data stored using this key (GitHub Advisory, NVD).

The vulnerability stems from the use of a hardcoded encryption key (GLPIKEY) that is publicly known and used across all GLPI installations. This implementation flaw is classified as CWE-798, which refers to the use of hard-coded credentials. The vulnerability allows potential attackers to decrypt sensitive data stored using this key, as the encryption key is not unique to each installation (GitHub Advisory).

The impact of this vulnerability is significant as it allows malicious actors to decrypt any sensitive data stored using the GLPIKEY encryption key. This includes passwords and other confidential information stored in the GLPI database (GitHub Advisory).

The vulnerability is relatively straightforward to exploit since the GLPIKEY is public knowledge and used consistently across all instances. Any attacker with access to the encrypted data can potentially decrypt it using the known key (GitHub Advisory).

The vulnerability was patched in GLPI version 9.4.6 with commit efd1446. The fix involves replacing the default encryption key with a unique key file per instance and adding a command to generate new keys and update the database. For existing installations, while it's possible to change the key before installing GLPI, updating existing data requires careful handling as it's difficult to identify all columns or rows in the database that use the encryption, especially from plugins (GitHub Advisory).