CVE-2020-11031: GLPI-Project GLPI

High severity, CVSS 7.5. EPSS: 0.3% chance of exploitation in the next 30 days.

In GLPI before version 9.5.0, the encryption algorithm used is insecure. The security of the data encrypted relies on the password used, if a user sets a weak/predictable password, an attacker could decrypt data. This is fixed in version 9.5.0 by using a more secure encryption library. The library chosen is sodium.

Affected products

• GLPI-Project GLPI: before 9.5.0 (fixed in 9.5.0)

Published 2020-09-23. Last modified 2026-06-17.