Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Loading CVE intelligence

Loading vulnerability catalog

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

Tool Directory

CVE-2020-5248

HighPublished

Public GLPIKEY can be used to decrypt any data in GLPI

Published: May 12, 2020
Updated: Aug 4, 2024
Assigning CNA: GitHub_M
Evidence observed: Aug 17, 2026

Primary CVSS

7.2/ 10High

nvd · CVSS 3.1

CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:N

EPSS probability estimate

1.5%

Low · next 30 days

Percentile: 73.2%
Model date: Sep 21, 2026

EPSS is a statistical estimate, not a certainty or a measure of impact. Combine it with CVSS, KEV status, exposure and your environment.

Summary

GLPI before before version 9.4.6 has a vulnerability involving a default encryption key. GLPIKEY is public and is used on every instance. This means anyone can decrypt sensitive data stored using this key. It is possible to change the key before installing GLPI. But on existing instances, data must be reencrypted with the new key. Problem is we can not know which columns or rows in the database are using that; espcially from plugins. Changing the key without updating data would lend in bad password sent from glpi; but storing them again from the UI will work.

Sources

CVE-2020-5248PoC
CVE-2020-5248
CVE-2020-5248PoC
Proof of Concept (PoC) for CVE-2020-5248.

Responsible use

Use vulnerability information only on systems you own or are authorized to test. Kitploit links to public research metadata and does not store exploit code or malicious payloads.