CVE-2023-28632

2023-04-0515:15:06

CWE-269

[email protected]

web.nvd.nist.gov

glpi

it management

asset management

cve-2023-28632

security vulnerability

email modification

account takeover

8.1 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

7.9 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

37.0%

JSON

GLPI is a free asset and IT management software package. Starting in version 0.83 and prior to versions 9.5.13 and 10.0.7, an authenticated user can modify emails of any user, and can therefore takeover another user account through the “forgotten password” feature. By modifying emails, the user can also receive sensitive data through GLPI notifications. Versions 9.5.13 and 10.0.7 contain a patch for this issue. As a workaround, account takeover can be prevented by deactivating all notifications related to Forgotten password? event. However, it will not prevent unauthorized modification of any user emails.

Affected configurations

Vulners

NVD

Node

glpi-projectglpiRange0.83–9.5.13

glpi-projectglpiRange10.0.0–10.0.7

VendorProductVersionCPE
glpi\-projectglpi*cpe:2.3:a:glpi\-project:glpi:*:*:*:*:*:*:*:*
glpi\-projectglpi*cpe:2.3:a:glpi\-project:glpi:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
glpi\-project	glpi	*	cpe:2.3:a:glpi\-project:glpi::::::::
glpi\-project	glpi	*	cpe:2.3:a:glpi\-project:glpi::::::::

CNA Affected

[
  {
    "vendor": "glpi-project",
    "product": "glpi",
    "versions": [
      {
        "version": ">= 0.83, < 9.5.13",
        "status": "affected"
      },
      {
        "version": ">= 10.0.0, < 10.0.7",
        "status": "affected"
      }
    ]
  }
]