Lucene search

GitHub_MCVELIST:CVE-2023-36808

HistoryJul 05, 2023 - 8:52 p.m.

CVE-2023-36808 GLPI vulnerable to SQL injection through Computer Virtual Machine information

2023-07-0520:52:48

CWE-89

GitHub_M

www.cve.org

glpi

cve-2023-36808

sql injection

computer virtual machine

patch

workaround

8.6 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

0.001 Low

EPSS

Percentile

43.4%

JSON

GLPI is a free asset and IT management software package. Starting in version 0.80 and prior to version 10.0.8, Computer Virtual Machine form and GLPI inventory request can be used to perform a SQL injection attack. Version 10.0.8 has a patch for this issue. As a workaround, one may disable native inventory.

CNA Affected

[
  {
    "vendor": "glpi-project",
    "product": "glpi",
    "versions": [
      {
        "version": ">= 0.80, < 10.0.8",
        "status": "affected"
      }
    ]
  }
]

References

github.com/glpi-project/glpi/releases/tag/10.0.8

github.com/glpi-project/glpi/security/advisories/GHSA-vf5h-jh9q-2gjm

8.6 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

0.001 Low

EPSS

Percentile

43.4%

JSON

Related for CVELIST:CVE-2023-36808