Lucene search

[email protected]CVE-2023-28639

HistoryApr 05, 2023 - 6:15 p.m.

CVE-2023-28639

2023-04-0518:15:08

CWE-79

[email protected]

web.nvd.nist.gov

glpi

asset management

it management

software

cve-2023-28639

reflected xss

vulnerability

security issue

6.1 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

6.3 Medium

AI Score

Confidence

High

5.8 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:P/A:N

0.001 Low

EPSS

Percentile

38.4%

JSON

GLPI is a free asset and IT management software package. Starting in version 0.85 and prior to versions 9.5.13 and 10.0.7, a malicious link can be crafted by an unauthenticated user. It will be able to exploit a reflected XSS in case any authenticated user opens the crafted link. This issue is fixed in versions 9.5.13 and 10.0.7.

CPENameOperatorVersion
glpi-project:glpiglpi-project glpilt9.5.13
glpi-project:glpiglpi-project glpieq0.90
glpi-project:glpiglpi-project glpieq9.3.0
glpi-project:glpiglpi-project glpieq9.4.0
glpi-project:glpiglpi-project glpieq9.1.3
glpi-project:glpiglpi-project glpieq9.4.3
glpi-project:glpiglpi-project glpieq9.1.0
glpi-project:glpiglpi-project glpieq9.2.1
glpi-project:glpiglpi-project glpieq9.3.2
glpi-project:glpiglpi-project glpieq9.4.1

CPE	Name	Operator	Version
glpi-project:glpi	glpi-project glpi	lt	9.5.13
glpi-project:glpi	glpi-project glpi	eq	0.90
glpi-project:glpi	glpi-project glpi	eq	9.3.0
glpi-project:glpi	glpi-project glpi	eq	9.4.0
glpi-project:glpi	glpi-project glpi	eq	9.1.3
glpi-project:glpi	glpi-project glpi	eq	9.4.3
glpi-project:glpi	glpi-project glpi	eq	9.1.0
glpi-project:glpi	glpi-project glpi	eq	9.2.1
glpi-project:glpi	glpi-project glpi	eq	9.3.2
glpi-project:glpi	glpi-project glpi	eq	9.4.1

Rows per page:

1-10 of 621

References

github.com/glpi-project/glpi/releases/tag/10.0.7

github.com/glpi-project/glpi/releases/tag/9.5.13

github.com/glpi-project/glpi/security/advisories/GHSA-r93q-chh5-jgh4

6.1 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

6.3 Medium

AI Score

Confidence

High

5.8 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:P/A:N

0.001 Low

EPSS

Percentile

38.4%

JSON

Related for CVE-2023-28639

cvelist1 osv1 prion1 ubuntucve1 freebsd1 redos1