CVE-2024-31456

2024-05-0714:15:10

CWE-89

[email protected]

web.nvd.nist.gov

glpi

sql injection

vulnerability

map search

version 10.0.15

nvd

7.7 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

7.3 High

AI Score

Confidence

Low

JSON

GLPI is a Free Asset and IT Management Software package. Prior to 10.0.15, an authenticated user can exploit a SQL injection vulnerability from map search. This vulnerability is fixed in 10.0.15.

CPE configuration

Vulners

glpi-projectglpiRange<10.0.15

VendorProductVersionCPE
glpi\-projectglpi*cpe:2.3:a:glpi\-project:glpi:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
glpi\-project	glpi	*	cpe:2.3:a:glpi\-project:glpi::::::::

CNA Affected

[
  {
    "vendor": "glpi-project",
    "product": "glpi",
    "versions": [
      {
        "version": "< 10.0.15",
        "status": "affected"
      }
    ]
  }
]