CVE-2022-35946

🗓️ 14 Sep 2022 17:55:09Reported by GitHub_MType

cve🔗 web.nvd.nist.gov📰️ 3 Media mentions👁 310 Views🌐 WEB

GLPI is asset and IT management software. Vulnerability in plugin controller allows unauthorized access to low-level API to alter database data. Upgrade to v10.0.3 or remove front/plugin.form.php script

Reporter	Title	Published	Views	Family All 110
ALT Linux	Security fix for the ALT Linux 9 package glpi version 9.5.9-alt1	23 Sep 202200:00	–	altlinux
ALT Linux	Security fix for the ALT Linux 10 package glpi version 9.5.9-alt1	16 Sep 202200:00	–	altlinux
BDU FSTEC	GLPI SQL Injection	29 Jul 202400:00	–	bdu_fstec
CNNVD	GLPI SQL注入漏洞	14 Sep 202200:00	–	cnnvd
Cvelist	CVE-2022-35946 SQL injection through plugin controller in GLPI	14 Sep 202217:55	–	cvelist
EUVD	EUVD-2022-38795	3 Oct 202520:07	–	euvd
Mend	CVE-2022-35946	14 Sep 202217:55	–	mend
NCSC	Vulnerabilities fixed in Synology DiskStation Manager	16 Sep 202200:00	–	ncsc
NVD	CVE-2022-35946	14 Sep 202218:15	–	nvd
osv_ubuntu	UBUNTU-CVE-2022-35946	14 Sep 202218:15	–	osv_ubuntu

NVD

Vulners

Node

glpi-project glpiRange<10.0.3

[
  {
    "product": "glpi",
    "vendor": "glpi-project",
    "versions": [
      {
        "status": "affected",
        "version": ">= 0.72, < 10.0.3"
      }
    ]
  }
]

Source	Link
github	www.github.com/glpi-project/glpi/security/advisories/GHSA-92q5-pfr8-r9r2
github	www.github.com/glpi-project/glpi/commit/f542ec8378afbd8038aeca5975b15eca3f0574c8

Parameter	Position	Path	Description	CWE
request input	request body	/front/plugin.form.php	Improper validation of request input in the plugin controller allows an attacker with 'General setup' update rights to access the low-level API of the Plugin class and alter database data.	CWE-89