CVE-2022-35946

🗓️ 14 Sep 2022 17:55:09Reported by GitHub_MType

cve🔗 web.nvd.nist.gov📰️ 3 Media mentions👁 294 Views🌐 WEB

GLPI is asset and IT management software. Vulnerability in plugin controller allows unauthorized access to low-level API to alter database data. Upgrade to v10.0.3 or remove front/plugin.form.php script

Reporter	Title	Published	Views	Family All 108
ALT Linux	Security fix for the ALT Linux 9 package glpi version 9.5.9-alt1	23 Sep 202200:00	–	altlinux
ALT Linux	Security fix for the ALT Linux 10 package glpi version 9.5.9-alt1	16 Sep 202200:00	–	altlinux
BDU FSTEC	The vulnerability of the GLPI system’s request and incident handling process, related to improper neutralization of special elements used in SQL commands, allows attackers to compromise the integrity of the system.	29 Jul 202400:00	–	bdu_fstec
CNNVD	GLPI SQL注入漏洞	14 Sep 202200:00	–	cnnvd
Cvelist	CVE-2022-35946 SQL injection through plugin controller in GLPI	14 Sep 202217:55	–	cvelist
EUVD	EUVD-2022-38795	3 Oct 202520:07	–	euvd
NCSC	Vulnerabilities fixed in Synology DiskStation Manager	16 Sep 202200:00	–	ncsc
NVD	CVE-2022-35946	14 Sep 202218:15	–	nvd
OSV	UBUNTU-CVE-2022-35946	14 Sep 202218:15	–	osv
Prion	Design/Logic Flaw	14 Sep 202218:15	–	prion

NVD

Vulners

Node

glpi-project glpiRange<10.0.3

[
  {
    "product": "glpi",
    "vendor": "glpi-project",
    "versions": [
      {
        "status": "affected",
        "version": ">= 0.72, < 10.0.3"
      }
    ]
  }
]

Source	Link
github	www.github.com/glpi-project/glpi/security/advisories/GHSA-92q5-pfr8-r9r2
github	www.github.com/glpi-project/glpi/commit/f542ec8378afbd8038aeca5975b15eca3f0574c8

Parameter	Position	Path	Description	CWE
unspecified	request body	front/plugin.form.php	SQL injection vulnerability in GLPI plugin controller allowing to alter database data via unvalidated request input	CWE-89