CVSS: 6.5EPSS: 0%CPEs: 2EXPL: 0CVE-2023-28855 – Fields GLPI plugin vulnerable to unauthorized write access to additional fields
https://notcve.org/view.php?id=CVE-2023-28855
Fields is a GLPI plugin that allows users to add custom fields on GLPI items forms. Prior to versions 1.13.1 and 1.20.4, lack of access control check allows any authenticated user to write data to any fields container, including those to which they have no configured access. Versions 1.13.1 and 1.20.4 contain a patch for this issue. • https://github.com/pluginsGLPI/fields/commit/784260be7db185bb1e7d66b299997238c4c0205d https://github.com/pluginsGLPI/fields/releases/tag/1.13.1 https://github.com/pluginsGLPI/fields/releases/tag/1.20.4 https://github.com/pluginsGLPI/fields/security/advisories/GHSA-52vv-hm4x-8584 • CWE-269: Improper Privilege Management •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2019-12723
https://notcve.org/view.php?id=CVE-2019-12723
An issue was discovered in the Teclib Fields plugin through 1.9.2 for GLPI. it allows SQL Injection via container_id and old_order parameters to ajax/reorder.php by an unauthenticated user. Se detectó un problema en el plugin Fields hasta versión 1.9.2 de Teclib para GLPI. Esto permite una Inyección SQL por medio de los parámetros container_id y old_order en el archivo ajax/reorder.php por parte de un usuario no identificado. • https://github.com/pluginsGLPI/fields/blob/master/ajax/reorder.php https://github.com/pluginsGLPI/fields/pull/317 https://github.com/pluginsGLPI/fields/releases/tag/1.10.0 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •