Lucene search

Ubuntu.comUB:CVE-2023-22725

HistoryJan 26, 2023 - 12:00 a.m.

CVE-2023-22725

2023-01-2600:00:00

ubuntu.com

glpi free asset management software

cross-site scripting

administrator vulnerability

patch 10.0.6

6.2 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:N/A:N

0.001 Low

EPSS

Percentile

21.2%

JSON

GLPI is a Free Asset and IT Management Software package. Versions 0.6.0 and
above, prior to 10.0.6 are vulnerable to Cross-site Scripting. This
vulnerability allow for an administrator to create a malicious external
link. This issue is patched in 10.0.6.

OSVersionArchitecturePackageVersionFilename
ubuntu16.04noarchglpi< anyUNKNOWN

OS	Version	Architecture	Package	Version	Filename
ubuntu	16.04	noarch	glpi	< any	UNKNOWN

References

github.com/glpi-project/glpi/security/advisories/GHSA-f5g6-fxrw-pfj7

launchpad.net/bugs/cve/CVE-2023-22725

nvd.nist.gov/vuln/detail/CVE-2023-22725

security-tracker.debian.org/tracker/CVE-2023-22725

www.cve.org/CVERecord?id=CVE-2023-22725

6.2 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:N/A:N

0.001 Low

EPSS

Percentile

21.2%

JSON

Related for UB:CVE-2023-22725