CVE-2022-35946

🗓️ 14 Sep 2022 17:55:09Reported by GitHub_MType

cve🔗 web.nvd.nist.gov📰️ 3 Media mentions👁 274 Views

GLPI is asset and IT management software. Vulnerability in plugin controller allows unauthorized access to low-level API to alter database data. Upgrade to v10.0.3 or remove front/plugin.form.php script

Reporter	Title	Published	Views	Family All 108
ALT Linux	Security fix for the ALT Linux 9 package glpi version 9.5.9-alt1	23 Sep 202200:00	–	altlinux
ALT Linux	Security fix for the ALT Linux 10 package glpi version 9.5.9-alt1	16 Sep 202200:00	–	altlinux
CNNVD	GLPI SQL注入漏洞	14 Sep 202200:00	–	cnnvd
Cvelist	CVE-2022-35946 SQL injection through plugin controller in GLPI	14 Sep 202217:55	–	cvelist
EUVD	EUVD-2022-38795	3 Oct 202520:07	–	euvd
NCSC	Vulnerabilities fixed in Synology DiskStation Manager	16 Sep 202200:00	–	ncsc
NVD	CVE-2022-35946	14 Sep 202218:15	–	nvd
OSV	CVE-2022-35946 SQL injection through plugin controller in GLPI	14 Sep 202217:55	–	osv
OSV	UBUNTU-CVE-2022-35946	14 Sep 202218:15	–	osv
Prion	Design/Logic Flaw	14 Sep 202218:15	–	prion

NVD

Vulners

Node

glpi-project glpiRange<10.0.3

[
  {
    "product": "glpi",
    "vendor": "glpi-project",
    "versions": [
      {
        "status": "affected",
        "version": ">= 0.72, < 10.0.3"
      }
    ]
  }
]

Source	Link
github	www.github.com/glpi-project/glpi/commit/f542ec8378afbd8038aeca5975b15eca3f0574c8
github	www.github.com/glpi-project/glpi/security/advisories/GHSA-92q5-pfr8-r9r2