CyberRota Analysis
AI-GeneratedThe Tag plugin for GLPI versions prior to 2.14.4 is vulnerable to stored cross-site scripting due to improper HTML sanitization and output escaping when rendering tag names in the Kanban badge markup. This allows authenticated users with tag management permissions to inject malicious HTML, which can then execute in the browsers of users viewing the affected Kanban boards. Organizations using this plugin should prioritize patching to mitigate potential exploitation risks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
The Tag plugin for GLPI 11 before 2.14.4 stores the tag name without HTML sanitization and renders it into the Kanban badge markup via PluginTagTag::preKanbanContent() without output escaping, resulting in stored cross-site scripting. An authenticated user with TAG MANAGEMENT create or update rights can set a tag name containing HTML, which then executes in the browser of any user who opens the Kanban view of a ticket, problem, change, or project the tag is attached to.