CVE-2022-39323

🗓️ 03 Nov 2022 00:00:00Reported by GitHub_MType

cve🔗 web.nvd.nist.gov📰️ 5 Media mentions👁 84 Views

GLPI is a Free Asset and IT Management Software package with ITIL Service Desk features. Time based SQL injection in api REST user_token. Patched in v10.0.4. Workaround: disable user_token login on API Rest

Reporter	Title	Published	Views	Family All 108
ALT Linux	Security fix for the ALT Linux 9 package glpi version 9.5.10-alt1	4 Nov 202200:00	–	altlinux
ALT Linux	Security fix for the ALT Linux 10 package glpi version 9.5.10-alt1	4 Nov 202200:00	–	altlinux
BDU FSTEC	The vulnerability in the GLPI system’s handling of requests and incidents, related to improper neutralization of special elements used in SQL commands, allows an attacker to carry out an attack based on time, using SQL injections in the REST API user_token.	29 Jul 202400:00	–	bdu_fstec
Circl	CVE-2022-39323	3 Nov 202217:20	–	circl
CNNVD	GLPI SQL注入漏洞	3 Nov 202200:00	–	cnnvd
Cvelist	CVE-2022-39323 SQL Injection on REST API in GLPI	3 Nov 202200:00	–	cvelist
EUVD	EUVD-2022-41805	3 Oct 202520:07	–	euvd
NVD	CVE-2022-39323	3 Nov 202215:15	–	nvd
OSV	CVE-2022-39323 SQL Injection on REST API in GLPI	3 Nov 202200:00	–	osv
OSV	UBUNTU-CVE-2022-39323	3 Nov 202215:15	–	osv

NVD

Vulners

Node

glpi-project glpiRange9.1–10.0.4

[
  {
    "vendor": "glpi-project",
    "product": "glpi",
    "versions": [
      {
        "version": "< 10.0.4",
        "status": "affected"
      }
    ]
  }
]