A critical stored XSS vulnerability in GLPI allows unauthenticated attackers to execute malicious scripts within the context of the asset management application.

This vulnerability involves an improper neutralization of input during web page generation, specifically within the inventory endpoint. An unauthenticated attacker can store an XSS payload that executes when a user views the affected inventory data.

The ability for an unauthenticated user to store malicious scripts presents a significant risk to the integrity and confidentiality of the IT management environment. Successful exploitation could lead to session hijacking of administrative accounts, unauthorized actions performed on behalf of users, or the exfiltration of sensitive asset data. Given the CVSS score of 7.5, this high severity flaw requires prompt attention to prevent potential compromise of the IT infrastructure management platform.

Immediate Action: Update GLPI to version 11.0.6 or later to apply the necessary input sanitization and security fixes.

Proactive Monitoring: Review web server and application access logs for suspicious POST requests directed at inventory endpoints, particularly those containing script tags or encoded characters.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common XSS patterns in incoming traffic to the inventory module until the patch is applied.

Public Exploit Available: No (exploit_available: false)

Given the potential for unauthorized administrative access via session theft, organizations running GLPI 11.0.0 through 11.0.5 must prioritize upgrading to version 11.0.6. Applying this update is the only effective way to neutralize the stored XSS vector and secure the inventory management process against unauthenticated attackers.