Lucene search

GoogleOSV:CVE-2023-43813

HistoryDec 13, 2023 - 7:15 p.m.

CVE-2023-43813

2023-12-1319:15:07

Google

osv.dev

cve-2023-43813

glpi

sql injection

saved search feature

patch

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

7.8 High

AI Score

Confidence

Low

0.001 Low

EPSS

Percentile

26.0%

JSON

GLPI is a free asset and IT management software package. Starting in version 10.0.0 and prior to version 10.0.11, the saved search feature can be used to perform a SQL injection. Version 10.0.11 contains a patch for the issue.

CPENameOperatorVersion
glpieq10.0.3
glpieq9.5.1
glpieq10.0.0
glpieq9.5.3
glpieq9.4.6
glpieq9.5.6
glpieq10.0.0-rc3
glpieq9.4.0-rc1
glpieq9.5.0-rc2
glpieq0.90-RC2

Name	Operator	Version
glpi	eq	10.0.3
glpi	eq	9.5.1
glpi	eq	10.0.0
glpi	eq	9.5.3
glpi	eq	9.4.6
glpi	eq	9.5.6
glpi	eq	10.0.0-rc3
glpi	eq	9.4.0-rc1
glpi	eq	9.5.0-rc2
glpi	eq	0.90-RC2

Rows per page:

1-10 of 461

References

github.com/glpi-project/glpi/commit/4bd7f02d940953b9cbc9d285f7544bb0e490e75e

github.com/glpi-project/glpi/releases/tag/10.0.11

github.com/glpi-project/glpi/security/advisories/GHSA-94c3-fw5r-3362

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

7.8 High

AI Score

Confidence

Low

0.001 Low

EPSS

Percentile

26.0%

JSON

Related for OSV:CVE-2023-43813