Lucene search
HistoryFeb 01, 2024 - 6:15 p.m.
CVE-2024-23645
glpi it-management free-software xss-vulnerability upgrade-required
6.1 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
6.7 Medium
AI Score
Confidence
High
0.001 Low
EPSS
Percentile
20.6%
GLPI is a Free Asset and IT Management Software package. A malicious URL can be used to execute XSS on reports pages. Upgrade to 10.0.12.
Affected configurations
Node
glpi-projectglpiRange0.65–10.0.12
Related
osv
osv
CVE-2024-23645
2024-02-01 18:15:53
cvelist
cvelist
CVE-2024-23645 GLPI reflected XSS in reports pages
2024-02-01 15:24:57
prion
prion
Design/Logic Flaw
2024-02-01 18:15:00
cve
cve
CVE-2024-23645
2024-02-01 18:15:53
ubuntucve
ubuntucve
CVE-2024-23645
2024-02-01 00:00:00
nessus
nessus
freebsd
freebsd
GLPI -- multiple vulnerabilities
2024-02-01 00:00:00
6.1 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
6.7 Medium
AI Score
Confidence
High
0.001 Low
EPSS
Percentile
20.6%
Related for NVD:CVE-2024-23645