CVE-2020-11035: Fedoraproject Fedora

Critical severity, CVSS 9.3. EPSS: 0.9% chance of exploitation in the next 30 days.

In GLPI after version 0.83.3 and before version 9.4.6, the CSRF tokens are generated using an insecure algorithm. The implementation uses rand and uniqid and MD5 which does not provide secure values. This is fixed in version 9.4.6.

Affected products

• Fedoraproject Fedora: version 31 only; version 32 only
• GLPI-Project GLPI: from 0.83.3, before 9.4.6 (fixed in 9.4.6)

Published 2020-05-05. Last modified 2026-06-17.