Skip to content

11.0.10

Choose a tag to compare

View all tags
@trasher trasher released this 30 Sep 09:25
· 46 commits to 11.0/bugfixes since this release
11.0.10
2d24828

Caution

This release suffer a regression on plugins system. Consider upgrading shortly to version 11.0.11

This is a security release, upgrading is recommended

Download it Official Docker image

You will find below the list of security issues fixed in this bugfixes version:

  • [SECURITY - High] Authorization bypass in massive actions
  • [SECURITY - High] Privilege escalation via user cloning
  • [SECURITY - High] Improper rights checks in users deletion
  • [SECURITY - High] SQL Injection through form actors dropdown
  • [SECURITY - High] 2FA deactivation/modification on users with higher privileges
  • [SECURITY - High] Reflected XSS in the dashboard search result widget
  • [SECURITY - Medium] Users names enumaration via the planning feature
  • [SECURITY - Medium] Missing authorization checks in the planning feature

The full changelog is available for more details.

We would like to thank all people who contributed to this new version and all those who contributes regularly to the GLPI project!

Regards.

Assets 3
Loading