Synology Security Synology-SA-22:15 GLPI

[Synology RSS]

Multiple vulnerabilities allow remote attackers or remote authenticated users to obtain sensitive information, inject arbitrary web script or HTML or inject SQL command via a susceptible version of GLPI.

Continue reading...
- - -
Source: synology.com

 

[Jan Janowski]

It says fix is for 6.2, but does not say which update for 6.2 contains the fix.... and latest -6 update for 6.2 is dated much before today's date....... ??? Or, is the GLPI manually updated, and if so, where ??? Trying to understand before contacting son in law, who has my old 215J

 

[fredbert]

Does he use GLPI?

The announcement does say which update includes the fix:

Affected Products

Product	Severity	Fixed Release Availability
GLPI for DSM 6.2	Critical	Upgrade to 10.0.3-0146 or above.

Release Notes for GLPI | Synology Inc.

Release Notes for GLPI | Synology Inc.

www.synology.com

Synology Archive Download Site - Index of /download/Package/GLPI

archive.synology.com

 

[Jan Janowski]

Thought that it might be installed as part of DSM... ?? Dunno if he uses it, I don't know if I used it back in the day...... Did search on GLPI and I doubt I ever used it... Doesn't sound familiar at all...
From an end user standpoint, this is not the first time a Synology named app that I don't remember has been mentioned in Security Notification.....
Problem is: Determining if it is something I've used, or got automatically loaded in the past....

It's only when the fix is mentioned to be part of DSM upgrade, that I understand what's the upgrade path... A V10.x upgrade of an unfamiliar named APP not only confuses a person, but determining where to go for further info on that APP complicates the 'what-to-do'!