Lucene search

FreeBSD894F2491-6834-11EE-B06F-0050569CEB3A

HistorySep 27, 2023 - 12:00 a.m.

glpi-project -- SQL injection in ITIL actors in GLPI

2023-09-2700:00:00

vuxml.freebsd.org

glpi

sql injection

itil actors

upgrade

version 10.0.10

security advisory

software package

service desk

licenses tracking

software auditing

vulnerability

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

7.6

Confidence

Low

EPSS

0.001

Percentile

38.7%

JSON

[email protected] reports:

GLPI stands for Gestionnaire Libre de Parc Informatique is a Free
Asset and IT Management Software package, that provides ITIL Service
Desk features, licenses tracking and software auditing. The ITIL
actors input field from the Ticket form can be used to perform a
SQL injection. Users are advised to upgrade to version 10.0.10.
There are no known workarounds for this vulnerability.

OSVersionArchitecturePackageVersionFilename
FreeBSDanynoarchglpi= 10.0.8,1UNKNOWN
FreeBSDanynoarchglpi< 10.0.10,1UNKNOWN

OS	Version	Architecture	Package	Version	Filename
FreeBSD	any	noarch	glpi	= 10.0.8,1	UNKNOWN
FreeBSD	any	noarch	glpi	< 10.0.10,1	UNKNOWN

References

nvd.nist.gov/vuln/detail/CVE-2023-42461

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

7.6

Confidence

Low

EPSS

0.001

Percentile

38.7%

JSON

Related for 894F2491-6834-11EE-B06F-0050569CEB3A