Lucene search

FreeBSD6F6518AB-6830-11EE-B06F-0050569CEB3A

HistorySep 27, 2023 - 12:00 a.m.

Account takeover via SQL Injection in UI layout preferences in GLPI

2023-09-2700:00:00

vuxml.freebsd.org

glpi

sql injection

ui layout

account takeover

it management

upgrade

vulnerability

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

8.1

Confidence

Low

EPSS

0.001

Percentile

38.7%

JSON

[email protected] reports:

GLPI stands for Gestionnaire Libre de Parc Informatique is a Free
Asset and IT Management Software package, that provides ITIL Service
Desk features, licenses tracking and software auditing. UI layout
preferences management can be hijacked to lead to SQL injection.
This injection can be use to takeover an administrator account.
Users are advised to upgrade to version 10.0.10. There are no known
workarounds for this vulnerability.

OSVersionArchitecturePackageVersionFilename
FreeBSDanynoarchglpi= 10.0.0,1UNKNOWN
FreeBSDanynoarchglpi< 10.0.10,1UNKNOWN

OS	Version	Architecture	Package	Version	Filename
FreeBSD	any	noarch	glpi	= 10.0.0,1	UNKNOWN
FreeBSD	any	noarch	glpi	< 10.0.10,1	UNKNOWN

References

nvd.nist.gov/vuln/detail/CVE-2023-41320

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

8.1

Confidence

Low

EPSS

0.001

Percentile

38.7%

JSON

Related for 6F6518AB-6830-11EE-B06F-0050569CEB3A