Lucene search

GoogleOSV:CVE-2023-34107

HistoryJul 05, 2023 - 8:15 p.m.

CVE-2023-34107

2023-07-0520:15:10

Google

osv.dev

glpi

vulnerability

incorrect rights check

knowbaseitems

patch

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

6.9 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

30.4%

JSON

GLPI is a free asset and IT management software package. Versions of the software starting with 9.2.0 and prior to 10.0.8 have an incorrect rights check on a on a file accessible by an authenticated user, allows access to the view all KnowbaseItems. Version 10.0.8 has a patch for this issue.

CPENameOperatorVersion
glpieq10.0.3
glpieq9.5.1
glpieq10.0.0
glpieq9.5.3
glpieq9.4.6
glpieq9.5.6
glpieq10.0.0-rc3
glpieq9.4.0-rc1
glpieq9.5.0-rc2
glpieq0.90-RC2

Name	Operator	Version
glpi	eq	10.0.3
glpi	eq	9.5.1
glpi	eq	10.0.0
glpi	eq	9.5.3
glpi	eq	9.4.6
glpi	eq	9.5.6
glpi	eq	10.0.0-rc3
glpi	eq	9.4.0-rc1
glpi	eq	9.5.0-rc2
glpi	eq	0.90-RC2

Rows per page:

1-10 of 431

References

github.com/glpi-project/glpi/releases/tag/10.0.8

github.com/glpi-project/glpi/security/advisories/GHSA-966h-xrf5-pmj4

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

6.9 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

30.4%

JSON

Related for OSV:CVE-2023-34107