CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2022-31082 – SQL Injection via package deployment tasks in glpi-inventory-plugin
https://notcve.org/view.php?id=CVE-2022-31082
GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. glpi-inventory-plugin is a plugin for GLPI to handle inventory management. In affected versions a SQL injection can be made using package deployment tasks. This issue has been resolved in version 1.0.2. Users are advised to upgrade. Users unable to upgrade should delete the `front/deploypackage.public.php` file if they are not using the `deploy tasks` feature. • https://github.com/glpi-project/glpi-inventory-plugin/commit/0b805ca6fb2a0f9bde4af29fca4f703fdfbd8f66 https://github.com/glpi-project/glpi-inventory-plugin/security/advisories/GHSA-q6m7-h6rj-5wmw • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 1CVE-2022-31062 – Unauthenticated Local File Inclusion
https://notcve.org/view.php?id=CVE-2022-31062
### Impact A plugin public script can be used to read content of system files. ### Patches Upgrade to version 1.0.2. ### Workarounds `b/deploy/index.php` file can be deleted if deploy feature is not used. ### Impacto Un script público del plugin puede ser usado para leer el contenido de los archivos del sistema. ### Parches Actualizar a versión 1.0.2. ### Mitigaciones el archivo "b/deploy/index.php" puede ser eliminado si no es usada la función deploy GLPI Glpiinventory versions 1.0.1 and below suffer from a local file inclusion vulnerability. • https://www.exploit-db.com/exploits/51230 http://packetstormsecurity.com/files/171654/GLPI-Glpiinventory-1.0.1-Local-File-Inclusion.html https://github.com/glpi-project/glpi-inventory-plugin/security/advisories/GHSA-q33f-jcjf-p4v9 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •