LiveActive security incident?Get immediate response
CVE Record

CVE-2019-1010307: GLPI GLPI Product 9.3.1 is affected by: Cross Site Scripting (XSS).

GLPI GLPI Product 9.3.1 is affected by: Cross Site Scripting (XSS). The impact is: All dropdown values are vulnerable to XSS leading to privilege escalation and executing js on admin. The component is: /glpi/ajax/getDropDownValue.php. The attack vector is: 1- User Create a ticket , 2- Admin opens another ticket and click on the "Link Tickets" feature, 3- a request to the endpoint fetches js and executes it.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

GLPI 9.3.1 has a cross-site scripting flaw in dropdown value handling. A regular user can create ticket content that later runs JavaScript in an administrator's browser when the admin uses Link Tickets. The main business risk is administrator session abuse and privilege escalation inside the service desk platform.

Executive priority

Prioritize remediation if GLPI is used for internal support with broad user access. This is not confirmed as actively exploited, but admin-context XSS can turn routine ticket handling into account compromise or privilege escalation.

Technical view

The CVE describes XSS in /glpi/ajax/getDropDownValue.php affecting GLPI Product 9.3.1. Dropdown values are reported vulnerable, with execution triggered when an administrator requests linked-ticket dropdown data. No CVSS, CWE, confirmed patch version, or active exploitation evidence is provided in the bundle.

Likely exposure

Exposure appears limited to organizations running GLPI 9.3.1, especially where lower-privileged users can create tickets and administrators process or link tickets. Publicly reachable GLPI instances would have higher operational risk.

Exploitation context

The described scenario requires a user-created ticket and later administrator interaction with the Link Tickets feature. The source bundle does not show KEV listing, active exploitation, public exploit reliability, or exploitation at scale.

Researcher notes

Evidence is strongest for affected version and vulnerable component. The bundle does not provide CVSS, CWE, exact fixed release, exploit status, or proof details. Treat patch identification as dependent on GLPI's referenced release and bugfix materials.

Mitigation direction

  • Inventory GLPI deployments and identify any 9.3.1 instances.
  • Review GLPI vendor guidance and release notes for the corrected version.
  • Upgrade or apply vendor-supported fixes when confirmed by GLPI guidance.
  • Restrict ticket creation and admin access until remediation is complete.
  • Reduce administrator exposure by using least-privilege accounts for routine triage.

Validation and detection

  • Confirm the running GLPI version on all service desk systems.
  • Check whether /glpi/ajax/getDropDownValue.php exists in affected deployments.
  • Review ticket workflows where untrusted users influence dropdown values.
  • Inspect logs for unusual admin actions following ticket-linking activity.
  • Verify remediation against GLPI's official fixed code or release guidance.
Prepared
Confidence
medium
Sources
4

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

description · low confidence lookup

Privilege behavior lookup

The CVE wording references privilege impact, so privilege escalation and authorization behavior review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2019-1010307 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
0Timeline events
0ADP providers
3Source links

CVSS and timeline data

No CVSS vectors or timeline events were available in the normalized CVE source material.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
GLPIGLPI Product9.3.1Listed
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.