CVE catalog

CVE-2020-11032

UBUNTU-CVE-2020-11032

Severity: High · CVSS 7.6CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:N
Published: May 5, 2020, 12:00:00 AM UTC
Updated: Oct 24, 2025, 4:48:24 AM UTC
Source: [NVD] · [CVE record]
EPSS: 1.01% · Oct 27, 2026

In GLPI before version 9.4.6, there is a SQL injection vulnerability for all helpdesk instances. Exploiting this vulnerability requires a technician account. This is fixed in version 9.4.6.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Ubuntu	glpi	16.04	`0.84.8+dfsg.1-1`	vulnerable
Ubuntu	glpi	16.04	`0.84.8+dfsg.1-1ubuntu1`	vulnerable

Fixed-version evidence

OpenFactory catalog packages

No matching packages in this catalog.

Observed: Oct 23, 2026, 4:41:35 PM UTC

References

[https://osv.dev/vulnerability/UBUNTU-CVE-2020-11032]
[https://security.access.redhat.com/data/csaf/v2/vex/2020/cve-2020-11032.json]

[FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX]