10.0.15

This is a security release, upgrading is recommended

This release fixes a few security issues that have been recently discovered. Update is recommended!

You can download the GLPI 10.0.15 archive on GitHub.

You will find below the list of security issues fixed in this bugfixes version:

• [SECURITY - high] Authenticated SQL injection from map search (CVE-2024-31456)
• [SECURITY - high] Account takeover via SQL Injection in saved searches feature (CVE-2024-29889)

Also, here is a short list of main changes done in this version:

• [FIX] Fix used right by reservation form.
• [FIX] Do not rely on input to apply rules rights.
• [FIX] Always store updated SMTP Oauth refresh token.
• [TASK] Upgrade tinymce.

The full changelog is available for more details.

We would like to thank all people who contributed to this new version and all those who contributes regularly to the GLPI project!

Regards.

10.0.14

Due to a few regressions in the last (10.0.13), an early release is available.

Here is the list of corrections made in this version:

• [FIX] Fix assign field when suppliers assign is available
• [FIX] Switching entities issues

You can download the GLPI 10.0.14 archive on GitHub.

Regards.

10.0.13

This is a security release, upgrading is recommended

This release fixes a few security issues that have been recently discovered. Update is recommended!

You can download the GLPI 10.0.13 archive on GitHub.

You will find below the list of security issues fixed in this bugfixes version:

• [SECURITY - high] SQL Injection in through the search engine (CVE-2024-27096)
• [SECURITY - moderate] Blind SSRF using Arbitrary Object Instantiation (CVE-2024-27098)
• [SECURITY - moderate] Stored XSS in dashboards (CVE-2024-27104)
• [SECURITY - moderate] Reflected XSS in debug mode (CVE-2024-27914)
• [SECURITY - moderate] Sensitive fields access through dropdowns (CVE-2024-27930)
• [SECURITY - moderate] Users emails enumeration (CVE-2024-27937)

Also, here is a short list of main changes done in this version:

• [FIX] Error when creating a Ticket with SLA/OLA.
• [FIX] Weekly recurrent reservations creation does not work.

The full changelog is available for more details.

We would like to thank all people who contributed to this new version and all those who contributes regularly to the GLPI project!

Regards.

10.0.12

This is a security release, upgrading is recommended

This release fixes a few security issues that have been recently discovered. Update is recommended!

You can download the GLPI 10.0.12 archive on GitHub.

You will find below the list of security issues fixed in this bugfixes version:

• [SECURITY - moderate] Reflected XSS in reports pages (CVE-2024-23645)
• [SECURITY - moderate] LDAP Injection during authentication (CVE-2023-51446)

Also, here is a short list of main changes done in this version:

• [FIX] Regression with entity selector missing cache invalidation
• [FIX] Better handling of connection issues during LDAP synchronization
• [PERF] The entity selector get significant reduction of load time in some cases

The full changelog is available for more details.

We would like to thank all people who contributed to this new version and all those who contributes regularly to the GLPI project!

Regards.

10.0.11

This is a security release, upgrading is recommended

This release fixes a few security issues that have been recently discovered. Update is recommended!

You can download the GLPI 10.0.11 archive on GitHub.

You will find below the list of security issues fixed in this bugfixes version:

• [SECURITY - moderate] Authenticated SQL Injection (CVE-2023-43813)
• [SECURITY - high] SQL injection through inventory agent request (CVE-2023-46727)
• [SECURITY - high] Remote code execution from LDAP server configuration form on PHP 7.4 (CVE-2023-46726)

On this last point, we wanted to recall the 7.4 version of PHP is very outdated and not supported anymore by the developers!
You should upgrade on a recent version, at least 8.2 (8.0 will be outdated at the end of the year and 8.1 will be only with security fixes).

Also, here is a short list of main changes done in this version:

• [UX] Enhance pending reasons display
• [FIX] various LDAP fixes (timeout, location import, deletion/restoration scenarios)
• [FIX] several inventory fixes (unmanaged assets reconciliation, rules for phones, rules logs for discovery, Cisco stacks, removal of remote management)
• [FIX] several performance enhancements (defer entity tree loading, strong enhancement on actors loading, all assets query execution time, web cron removal, dual ajax call for tab loading)
• [TASK] highlights of security requirements on install/update page. Some options like PHP versions, web folder setup are suggested with a strong visual.

The full changelog is available for more details.

We would like to thank all people who contributed to this new version and all those who contributes regularly to the GLPI project!

Regards.

10.0.10

This is a security release, upgrading is recommended

This release fixes a security issue that has been recently discovered. Update is recommended!

You can download the GLPI 10.0.10 archive on GitHub.

You will find below security issues fixed in this bugfixes version:

• [SECURITY - Critical] Unallowed PHP script execution (CVE-2023-42802).
• [SECURITY - High] Account takeover via SQL Injection in UI layout preferences (CVE-2023-41320).
• [SECURITY - High] Account takeover via Kanban feature (CVE-2023-41326).
• [SECURITY - High] Account takeover through API (CVE-2023-41324).
• [SECURITY - High] File deletion through document upload process (CVE-2023-42462).
• [SECURITY - Moderate] Sensitive fields enumeration through API (CVE-2023-41321).
• [SECURITY - Moderate] Privilege Escalation from technician to super-admin (CVE-2023-41322).
• [SECURITY - Moderate] Users login enumeration by unauthenticated user (CVE-2023-41323).
• [SECURITY - Moderate] Phishing through a login page malicious URL (CVE-2023-41888).
• [SECURITY - Moderate] SQL injection in ITIL actors (CVE-2023-42461).

Also, here is a short list of main changes done in this version:

• [FEATURE] PHP 8.3 and MySQL 8.1 support.
• [FEATURE] Enable usage of images in rich text of followups/tasks/solution templates.
• [PERFORMANCES] Improve ticket timeline rendering performances.
• [FIX] Fix issues with usage of LDAP bind options.
• [FIX] Fix some issues on SLA/OLA escalation levels computation.
• [FIX] Fix some issues on search on numeric and dates fields.
• Several minor fixes

The full changelog is available for more details.

We would like to thank all people who contributed to this new version and all those who contributes regularly to the GLPI project!

Regards.

10.0.9

This is a security release, upgrading is recommended

This release fixes a security issue that has been recently discovered. Update is recommended!

You can download the GLPI 10.0.9 archive on GitHub.

You will find below the security issu fixed in this bugfixes version:

• [SECURITY - Moderate] SQL injection in dashboard administration (CVE-2023-37278).

Following the last releases of 10.0.8, a few annoying issues has been detected:

• Update script uses a SQL function incompatible with MySQL 5.7 (#15141)
• Private follow-ups and tasks are invisible to users with appropriate rights (#15128)
• Several minor fixes

The full changelog is available for more details.

We would like to thank all people who contributed to this new version and all those who contributes regularly to the GLPI project!

Regards.

10.0.8

This is a security release, upgrading is recommended

This release fixes several security issues that has been recently discovered. Update is recommended!

You can download the GLPI 10.0.8 archive on GitHub.

You will find below the list of security issues fixed in this bugfixes version:

• [SECURITY - High] SQL injection via inventory agent request (CVE-2023-35924).
• [SECURITY - High] SQL injection through Computer Virtual Machine information (CVE-2023-36808).
• [SECURITY - High] Unauthorized access to Dashboard data (CVE-2023-35939).
• [SECURITY - High] Unauthenticated access to Dashboard data (CVE-2023-35940).
• [SECURITY - Moderate] Reflected XSS in search pages (CVE-2023-34244).
• [SECURITY - Moderate] Unauthorized access to knowledge base items (CVE-2023-34107).
• [SECURITY - Moderate] Unauthorized access to user data (CVE-2023-34106).

Also, here is a short list of main changes done in this version:

• [FEATURE] Improve mail grouping (#14296)
• [FEATURE] Add deleted status in item's header (#14382)
• [FEATURE] Add option to control the display of dropdowns labels (#14472)
• [FEATURE] Permits to check DB schema from GLPI versions >= 0.80 (#14666)
• [FIX] Improve performance of plugins init (#14511)
• [FIX] Improve performance of kanban views (#14525, #14599, #14764)
• [FIX] Ldap issues with PHP versions >= 8.1 (#14561)
• [FIX] SLA waiting time duration (#14937)
• [FIX] Notification encoding for MS Outlook (#14959)
• A lot of fixes in native inventory

The full changelog is available for more details.

We would like to thank all people who contributed to this new version and all those who contributes regularly to the GLPI project!

Regards.

10.0.7

This is a security release, upgrading is recommended

This release fixes several security issues that has been recently discovered. Update is recommended!

You can download the GLPI 10.0.7 archive on GitHub.

You will find below the list of security issues fixed in this bugfixes version:

• [SECURITY - High] SQL injection and Stored XSS via inventory agent request (CVE-2023-28849).
• [SECURITY - High] Account takeover by authenticated user (CVE-2023-28632).
• [SECURITY - High] SQL injection through dynamic reports (CVE-2023-28838).
• [SECURITY - Moderate] Stored XSS through dashboard administration (CVE-2023-28852).
• [SECURITY - Moderate] Stored XSS on external links (CVE-2023-28636).
• [SECURITY - Moderate] Reflected XSS in search pages (CVE-2023-28639).
• [SECURITY - Moderate] Privilege Escalation from technician to super-admin (CVE-2023-28634).
• [SECURITY - Low] Blind Server-Side Request Forgery (SSRF) in RSS feeds (CVE-2023-28633).

Also, here is a short list of main changes done in this version:

• [SECURITY] Optional GLPI router to be able to use a safer web server root directory.
• [FEATURE] Support of SMTP OAuth authentication.
• [FEATURE] Improved inventory file upload feature.
• [FIX] Many fixes and improvements on native inventory.
• [FIX] Some bugs on PHP 8.2.
• [FIX] Caching issues on entities.
• [FIX] Boolean FullText operator not working on knowledge base search.
• [FIX] Unexpected search results when using negative condition on ticket actors.
• [FIX] Issues with LDAP filters/DN.
• [FIX] Unexpected results when searching on knowledge base categories.

The full changelog is available for more details.

We would like to thank all people who contributed to this new version and all those who contributes regularly to the GLPI project!

Regards.

9.5.13

This release fixes several security issues that have been recently discovered. Update is recommended!

You can download the GLPI 9.5.13 archive on GitHub.

You will find below the list of security issues fixed in this bugfixes version:

• [SECURITY - High] Account takeover by authenticated user (CVE-2023-28632).
• [SECURITY - High] SQL injection through dynamic reports (CVE-2023-28838).
• [SECURITY - Moderate] Stored XSS through dashboard administration (CVE-2023-28852).
• [SECURITY - Moderate] Stored XSS on external links (CVE-2023-28636).
• [SECURITY - Moderate] Reflected XSS in search pages (CVE-2023-28639).
• [SECURITY - Moderate] Privilege Escalation from technician to super-admin (CVE-2023-28634).
• [SECURITY - Low] Blind Server-Side Request Forgery (SSRF) in RSS feeds (CVE-2023-28633).

Regards.