Lucene search

GoogleOSV:CVE-2023-37278

HistoryJul 13, 2023 - 11:15 p.m.

CVE-2023-37278

2023-07-1323:15:10

Google

osv.dev

glpi

free

asset

management

software

sql injection

vulnerability

patched

version 10.0.9

CVSS3

9.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

AI Score

8.2

Confidence

Low

EPSS

0.001

Percentile

32.5%

JSON

GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. An administrator can trigger SQL injection via dashboards administration. This vulnerability has been patched in version 10.0.9.

References

github.com/glpi-project/glpi/releases/tag/10.0.9

github.com/glpi-project/glpi/security/advisories/GHSA-46gp-f96h-53w4

CVSS3

9.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

AI Score

8.2

Confidence

Low

EPSS

0.001

Percentile

32.5%

JSON

Related for OSV:CVE-2023-37278