CVE-2014-8360
Directory traversal vulnerability in inc/autoload.function.php in GLPI before 0.84.8 allows...
Directory traversal vulnerability in inc/autoload.function.php in GLPI before 0.84.8 allows remote attackers to include and execute arbitrary local files via a .._ (dot dot underscore) in an item type to the getItemForItemtype, as demonstrated by the itemtype parameter in ajax/common.tabs.php.
Exploit likelihood
What each source reports
NVD Score used
Directory traversal vulnerability in inc/autoload.function.php in GLPI before 0.84.8 allows remote attackers to include and execute arbitrary local files via a .._ (dot dot underscore) in an item type to the getItemForItemtype, as demonstrated by the itemtype parameter in ajax/common.tabs.php.
- Record
CVE-2014-8360- CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-22
- Updated
- 2026-11-02
CVE List No score
Directory traversal vulnerability in inc/autoload.function.php in GLPI before 0.84.8 allows remote attackers to include and execute arbitrary local files via a .._ (dot dot underscore) in an item type to the getItemForItemtype, as demonstrated by the itemtype parameter in ajax/common.tabs.php.
- Record
CVE-2014-8360- Updated
- 2026-11-02
EUVDEUVD-2014-8197 No score
Directory traversal vulnerability in inc/autoload.function.php in GLPI before 0.84.8 allows remote attackers to include and execute arbitrary local files via a .._ (dot dot underscore) in an item type to the getItemForItemtype, as demonstrated by the itemtype parameter in ajax/common.tabs.php.
- Record
EUVD-2014-8197- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-6672-57h5-f9rw No score
Directory traversal vulnerability in inc/autoload.function.php in GLPI before 0.84.8 allows...
Directory traversal vulnerability in inc/autoload.function.php in GLPI before 0.84.8 allows remote attackers to include and execute arbitrary local files via a .._ (dot dot underscore) in an item type to the getItemForItemtype, as demonstrated by the itemtype parameter in ajax/common.tabs.php.
- Record
GHSA-6672-57h5-f9rw- Weakness
- CWE-22
- Updated
- 2026-11-02
OSVMGASA-2015-0017 No score
Updated glpi package fixes security vulnerabilities
Updated glpi package fixes security vulnerabilities:
Due to a bug in GLPI before 0.84.7, a user without access to cost information can in fact see the information when selecting cost as a search criteria (CVE-2014-5032).
An issue in GLPI before 0.84.8 may allow arbitrary local files to be included by PHP through an autoload function (CVE-2014-8360).
SQL injection vulnerability in ajax/getDropdownValue.php in GLPI before 0.85.1 allows remote authenticated users to execute arbitrary SQL commands via the condition parameter (CVE-2014-9258).
- Record
MGASA-2015-0017- Updated
- 2026-11-02
OSVUBUNTU-CVE-2014-8360 No score
Directory traversal vulnerability in inc/autoload.function.php in GLPI before 0.84.8 allows remote attackers to include and execute arbitrary local files via a .._ (dot dot underscore) in an item type to the getItemForItemtype, as demonstrated by the itemtype parameter in ajax/common.tabs.php.
- Record
UBUNTU-CVE-2014-8360- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
glpiMageia:4 From an advisory covering 3 CVEs |
before 0.84.3-1.2.mga4 | 0.84.3-1.2.mga4 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| affected | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2014-8360 is a high vulnerability (CVSS 7.5) in Glpi-project Glpi, published January 9, 2015. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.83%, the 86th percentile. No source names a fixed version.
References
mandriva.com/security/advisories?name=MDVSA-2015:167
glpi-project.org/spip.php?page=annonce&id_breve=330
advisories.mageia.org/MGASA-2015-0017.html
tlk.tuxfamily.org/doku.php?id=writeup:cve-2014-8360-en
forge.indepnet.net/issues/5101
nvd.nist.gov/vuln/detail/CVE-2014-8360
Show 11 moreShow less
github.com/advisories/GHSA-6672-57h5-f9rw
bugs.mageia.org/show_bug.cgi?id=14933
lists.fedoraproject.org/pipermail/package-announce/2015-January/147296.html
ubuntu.com/security/CVE-2014-8360
forge.glpi-project.org/issues/5101
cve.org/CVERecord?id=CVE-2014-8360