Lucene search

PRIOn knowledge basePRION:CVE-2023-36808

HistoryJul 05, 2023 - 9:15 p.m.

Sql injection

2023-07-0521:15:00

PRIOn knowledge base

www.prio-n.com

glpi

sql injection

vulnerability

version 10.0.8

workaround

9.7 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

43.4%

JSON

GLPI is a free asset and IT management software package. Starting in version 0.80 and prior to version 10.0.8, Computer Virtual Machine form and GLPI inventory request can be used to perform a SQL injection attack. Version 10.0.8 has a patch for this issue. As a workaround, one may disable native inventory.

CPENameOperatorVersion
glpige0.80
glpilt10.0.8

CPE	Name	Operator	Version
	glpi	ge	0.80
	glpi	lt	10.0.8

References

github.com/glpi-project/glpi/releases/tag/10.0.8

github.com/glpi-project/glpi/security/advisories/GHSA-vf5h-jh9q-2gjm