Lucene search

GoogleOSV:CVE-2023-46726

HistoryDec 13, 2023 - 7:15 p.m.

CVE-2023-46726

2023-12-1319:15:07

Google

osv.dev

glpi

arbitrary code execution

ldap server

php 7.4

security patch

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

7.9 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

40.2%

JSON

GLPI is a free asset and IT management software package. Starting in version 10.0.0 and prior to version 10.0.11, on PHP 7.4 only, the LDAP server configuration form can be used to execute arbitrary code previously uploaded as a GLPI document. Version 10.0.11 contains a patch for the issue.

CPENameOperatorVersion
glpieq10.0.3
glpieq9.5.1
glpieq10.0.0
glpieq9.5.3
glpieq9.4.6
glpieq9.5.6
glpieq10.0.0-rc3
glpieq9.4.0-rc1
glpieq9.5.0-rc2
glpieq0.90-RC2

Name	Operator	Version
glpi	eq	10.0.3
glpi	eq	9.5.1
glpi	eq	10.0.0
glpi	eq	9.5.3
glpi	eq	9.4.6
glpi	eq	9.5.6
glpi	eq	10.0.0-rc3
glpi	eq	9.4.0-rc1
glpi	eq	9.5.0-rc2
glpi	eq	0.90-RC2

Rows per page:

1-10 of 461

References

github.com/glpi-project/glpi/commit/42ba2b031bec0b3889317db25f3adf9080fc11b2

github.com/glpi-project/glpi/releases/tag/10.0.11

github.com/glpi-project/glpi/security/advisories/GHSA-qc92-gxc6-5f95

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

7.9 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

40.2%

JSON

Related for OSV:CVE-2023-46726