CVSS: 7.7EPSS: 0%CPEs: 1EXPL: 0CVE-2024-45600 – Fields GLPI plugin has an Authenticated SQL Injection
https://notcve.org/view.php?id=CVE-2024-45600
26 Dec 2024 — Fields is a GLPI plugin that allows users to add custom fields on GLPI items forms. Prior to 1.21.13, an authenticated user can perform a SQL injection when the plugin is active. The vulnerability is fixed in 1.21.13. • https://github.com/pluginsGLPI/fields/commit/eb927b0f084ee4ef6c87ab2eb7a15e99369e74ae#diff-a7024a397fba9a026157683da73cc675ec6b73bd900374b3836bcdc76ec7bd5cR1166 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 6.8EPSS: 0%CPEs: 2EXPL: 0CVE-2023-28855 – Fields GLPI plugin vulnerable to unauthorized write access to additional fields
https://notcve.org/view.php?id=CVE-2023-28855
05 Apr 2023 — Fields is a GLPI plugin that allows users to add custom fields on GLPI items forms. Prior to versions 1.13.1 and 1.20.4, lack of access control check allows any authenticated user to write data to any fields container, including those to which they have no configured access. Versions 1.13.1 and 1.20.4 contain a patch for this issue. • https://github.com/pluginsGLPI/fields/commit/784260be7db185bb1e7d66b299997238c4c0205d • CWE-269: Improper Privilege Management •
CVSS: 9.8EPSS: 1%CPEs: 1EXPL: 0CVE-2019-12723
https://notcve.org/view.php?id=CVE-2019-12723
10 Jul 2019 — An issue was discovered in the Teclib Fields plugin through 1.9.2 for GLPI. it allows SQL Injection via container_id and old_order parameters to ajax/reorder.php by an unauthenticated user. Se detectó un problema en el plugin Fields hasta versión 1.9.2 de Teclib para GLPI. Esto permite una Inyección SQL por medio de los parámetros container_id y old_order en el archivo ajax/reorder.php por parte de un usuario no identificado. • https://github.com/pluginsGLPI/fields/blob/master/ajax/reorder.php • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •