CVE-2023-28633

2023-04-0500:00:00

ubuntu.com

glpi

ssrf

rss

vulnerability

patch

unix

autodiscovery

5.4 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

0.001 Low

EPSS

Percentile

30.8%

JSON

GLPI is a free asset and IT management software package. Starting in
version 0.84 and prior to versions 9.5.13 and 10.0.7, usage of RSS feeds is
subject to server-side request forgery (SSRF). In case the remote address
is not a valid RSS feed, an RSS autodiscovery feature is triggered. This
feature does not check safety or URLs. Versions 9.5.13 and 10.0.7 contain a
patch for this issue.