Lucene search

GoogleOSV:CVE-2023-36808

HistoryJul 05, 2023 - 9:15 p.m.

CVE-2023-36808

2023-07-0521:15:10

Google

osv.dev

glpi

sql injection

cve-2023-36808

vulnerability

fix

workaround

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

8 High

AI Score

Confidence

Low

0.001 Low

EPSS

Percentile

43.6%

JSON

GLPI is a free asset and IT management software package. Starting in version 0.80 and prior to version 10.0.8, Computer Virtual Machine form and GLPI inventory request can be used to perform a SQL injection attack. Version 10.0.8 has a patch for this issue. As a workaround, one may disable native inventory.

References

github.com/glpi-project/glpi/releases/tag/10.0.8

github.com/glpi-project/glpi/security/advisories/GHSA-vf5h-jh9q-2gjm

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

8 High

AI Score

Confidence

Low

0.001 Low

EPSS

Percentile

43.6%

JSON

Related for OSV:CVE-2023-36808