Lucene search

GitHub_MCVELIST:CVE-2023-37278

HistoryJul 13, 2023 - 10:37 p.m.

CVE-2023-37278 GLPI vulnerable to SQL injection via dashboard administration

2023-07-1322:37:29

CWE-89

GitHub_M

www.cve.org

glpi

sql injection

vulnerability

patched

version 10.0.9

CVSS3

6.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N

AI Score

9.8

Confidence

High

EPSS

0.001

Percentile

32.5%

JSON

GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. An administrator can trigger SQL injection via dashboards administration. This vulnerability has been patched in version 10.0.9.

CNA Affected

[
  {
    "vendor": "glpi-project",
    "product": "glpi",
    "versions": [
      {
        "version": ">= 9.5.0, < 10.0.9",
        "status": "affected"
      }
    ]
  }
]

References

github.com/glpi-project/glpi/releases/tag/10.0.9

github.com/glpi-project/glpi/security/advisories/GHSA-46gp-f96h-53w4

CVSS3

6.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N

AI Score

9.8

Confidence

High

EPSS

0.001

Percentile

32.5%

JSON

Related for CVELIST:CVE-2023-37278