An authenticated stored cross-site scripting vulnerability in GLPI allows a malicious technician to execute arbitrary scripts in the browsers of other users, posing a risk of session hijacking.

This is a stored cross-site scripting (XSS) vulnerability caused by improper output encoding in the supplier website fields. An authenticated technician can store malicious markup that triggers in the browsers of other users who view the affected supplier records.

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of a victim user's session. This can lead to unauthorized actions performed on behalf of the user, potential credential theft, or session hijacking. Given the CVSS score of 8.5, this high-severity flaw represents a significant risk to the integrity and confidentiality of the IT management environment.

Immediate Action: Upgrade the GLPI installation to version 11.0.8 or later to incorporate the necessary output sanitization.

Proactive Monitoring: Review application access logs for suspicious activity involving the modification of supplier data or unusual script execution patterns.

Compensating Controls: Deploy a Web Application Firewall (WAF) with strict XSS filtering rules to inspect input fields for malicious scripts until the software can be patched.

Public Exploit Available: Unknown

Administrators should prioritize updating to version 11.0.8 immediately to eliminate the risk of script injection. As this vulnerability requires technician-level authentication, ensure that administrative accounts are secured with strong credentials and multi-factor authentication to prevent unauthorized access by malicious actors.