Ubuntu.comUB:CVE-2022-29250CVE-2022-29250
4 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
SINGLE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:L/Au:S/C:N/I:P/A:N
8.1 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
6.5 Medium
AI Score
Confidence
High
0.001 Low
EPSS
Percentile
22.7%
GLPI is a Free Asset and IT Management Software package, that provides ITIL
Service Desk features, licenses tracking and software auditing. In versions
prior to version 10.0.1 it is possible to add extra information by SQL
injection on search pages. In order to exploit this vulnerability a user
must be logged in.
Notes
| Author | Note |
|---|---|
| Priority reason: GLPI developers have rated this as being a low severity issue |
Related
4 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
SINGLE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:L/Au:S/C:N/I:P/A:N
8.1 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
6.5 Medium
AI Score
Confidence
High
0.001 Low
EPSS
Percentile
22.7%