Lucene search

FreeBSDB14A6DDC-6821-11EE-B06F-0050569CEB3A

HistoryJul 05, 2023 - 12:00 a.m.

GLPI vulnerable to reflected XSS in search pages

2023-07-0500:00:00

vuxml.freebsd.org

glpi

reflected xss

security advisory

upgrade

version 10.0.8

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

AI Score

7.2

Confidence

Low

EPSS

0.001

Percentile

35.9%

JSON

[email protected] reports:

GLPI is a free asset and IT management software package. Starting
in version 9.4.0 and prior to version 10.0.8, a malicious link can
be crafted by an unauthenticated user that can exploit a reflected
XSS in case any authenticated user opens the crafted link. Users
should upgrade to version 10.0.8 to receive a patch.

OSVersionArchitecturePackageVersionFilename
FreeBSDanynoarchglpi= 9.4.0,1UNKNOWN
FreeBSDanynoarchglpi< 10.0.8,1UNKNOWN

OS	Version	Architecture	Package	Version	Filename
FreeBSD	any	noarch	glpi	= 9.4.0,1	UNKNOWN
FreeBSD	any	noarch	glpi	< 10.0.8,1	UNKNOWN

References

nvd.nist.gov/vuln/detail/CVE-2023-34244

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

AI Score

7.2

Confidence

Low

EPSS

0.001

Percentile

35.9%

JSON

Related for B14A6DDC-6821-11EE-B06F-0050569CEB3A