Lucene search

FreeBSD5DA8B1E6-0591-11EF-9E00-080027957747

HistoryApr 03, 2024 - 12:00 a.m.

GLPI -- multiple vulnerabilities

2024-04-0300:00:00

vuxml.freebsd.org

glpi

vulnerabilities

authenticated

sql injection

account takeover

map search

saved searches

unix

7.7 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

9 High

AI Score

Confidence

Low

0.0004 Low

EPSS

Percentile

9.1%

JSON

GLPI team reports:

GLPI 10.0.15 Changelog

[SECURITY - high] Authenticated SQL injection from map search (CVE-2024-31456)
[SECURITY - high] Account takeover via SQL Injection in saved searches feature (CVE-2024-29889)

OSVersionArchitecturePackageVersionFilename
FreeBSDanynoarchglpi< 10.0.15,1UNKNOWN

OS	Version	Architecture	Package	Version	Filename
FreeBSD	any	noarch	glpi	< 10.0.15,1	UNKNOWN

References

github.com/glpi-project/glpi/releases/tag/10.0.15

7.7 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

9 High

AI Score

Confidence

Low

0.0004 Low

EPSS

Percentile

9.1%

JSON

Related for 5DA8B1E6-0591-11EF-9E00-080027957747