Lucene search

[email protected]CVE-2022-34127

HistoryApr 16, 2023 - 3:15 a.m.

CVE-2022-34127

2023-04-1603:15:07

CWE-22

[email protected]

web.nvd.nist.gov

227

cve-2022-34127

managentities

glpi

file reading

directory traversal

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

0.021 Low

EPSS

Percentile

89.1%

JSON

The Managentities plugin before 4.0.2 for GLPI allows reading local files via directory traversal in the inc/cri.class.php file parameter.

CPENameOperatorVersion
glpi-project:manageentitiesglpi-project manageentitieslt4.0.2
glpi-project:manageentitiesglpi-project manageentitieseq3.0.0
glpi-project:manageentitiesglpi-project manageentitieseq4.0.1
glpi-project:manageentitiesglpi-project manageentitieseq2.2.0
glpi-project:manageentitiesglpi-project manageentitieseq3.1.0
glpi-project:manageentitiesglpi-project manageentitieseq4.0.0
glpi-project:manageentitiesglpi-project manageentitieseq3.2.1
glpi-project:manageentitiesglpi-project manageentitieseq3.0.1
glpi-project:manageentitiesglpi-project manageentitieseq3.2.0
glpi-project:manageentitiesglpi-project manageentitieseq3.2.2

CPE	Name	Operator	Version
glpi-project:manageentities	glpi-project manageentities	lt	4.0.2
glpi-project:manageentities	glpi-project manageentities	eq	3.0.0
glpi-project:manageentities	glpi-project manageentities	eq	4.0.1
glpi-project:manageentities	glpi-project manageentities	eq	2.2.0
glpi-project:manageentities	glpi-project manageentities	eq	3.1.0
glpi-project:manageentities	glpi-project manageentities	eq	4.0.0
glpi-project:manageentities	glpi-project manageentities	eq	3.2.1
glpi-project:manageentities	glpi-project manageentities	eq	3.0.1
glpi-project:manageentities	glpi-project manageentities	eq	3.2.0
glpi-project:manageentities	glpi-project manageentities	eq	3.2.2

References

github.com/InfotelGLPI/manageentities/releases/tag/4.0.2

github.com/InfotelGLPI/manageentities/security/advisories/GHSA-4hpg-m8fv-xv3h

pentest.blog/advisory-glpi-service-management-software-sql-injection-remote-code-execution-and-local-file-inclusion/

Social References

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

0.021 Low

EPSS

Percentile

89.1%

JSON

Related for CVE-2022-34127

packetstorm1 zdt1 cvelist1 osv1 prion1 exploitdb1