Lucene search

Ubuntu.comUB:CVE-2022-39323

HistoryNov 03, 2022 - 12:00 a.m.

CVE-2022-39323

2022-11-0300:00:00

ubuntu.com

glpi

gestionnaire libre de parc informatique

security vulnerability

unix

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

Confidence

High

EPSS

0.001

Percentile

50.2%

JSON

GLPI stands for Gestionnaire Libre de Parc Informatique. GLPI is a Free
Asset and IT Management Software package that provides ITIL Service Desk
features, licenses tracking and software auditing. Time based attack using
a SQL injection in api REST user_token. This issue has been patched, please
upgrade to version 10.0.4. As a workaround, disable login with user_token
on API Rest.

OSVersionArchitecturePackageVersionFilename
ubuntu16.04noarchglpi< anyUNKNOWN

OS	Version	Architecture	Package	Version	Filename
ubuntu	16.04	noarch	glpi	< any	UNKNOWN

References

github.com/glpi-project/glpi/security/advisories/GHSA-cp6q-9p4x-8hr9

launchpad.net/bugs/cve/CVE-2022-39323

nvd.nist.gov/vuln/detail/CVE-2022-39323

security-tracker.debian.org/tracker/CVE-2022-39323

www.cve.org/CVERecord?id=CVE-2022-39323

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

Confidence

High

EPSS

0.001

Percentile

50.2%

JSON

Related for UB:CVE-2022-39323