CVSS: 8.1EPSS: 0%CPEs: 2EXPL: 0CVE-2023-28632 – GLPI vulnerable to account takeover by authenticated user
https://notcve.org/view.php?id=CVE-2023-28632
GLPI is a free asset and IT management software package. Starting in version 0.83 and prior to versions 9.5.13 and 10.0.7, an authenticated user can modify emails of any user, and can therefore takeover another user account through the "forgotten password" feature. By modifying emails, the user can also receive sensitive data through GLPI notifications. Versions 9.5.13 and 10.0.7 contain a patch for this issue. As a workaround, account takeover can be prevented by deactivating all notifications related to `Forgotten password? • https://github.com/glpi-project/glpi/releases/tag/10.0.7 https://github.com/glpi-project/glpi/releases/tag/9.5.13 https://github.com/glpi-project/glpi/security/advisories/GHSA-7pwm-pg76-3q9x • CWE-269: Improper Privilege Management •
CVSS: 6.1EPSS: 0%CPEs: 2EXPL: 0CVE-2023-28639 – GLPI vulnerable to reflected Cross-site Scripting in search pages
https://notcve.org/view.php?id=CVE-2023-28639
GLPI is a free asset and IT management software package. Starting in version 0.85 and prior to versions 9.5.13 and 10.0.7, a malicious link can be crafted by an unauthenticated user. It will be able to exploit a reflected XSS in case any authenticated user opens the crafted link. This issue is fixed in versions 9.5.13 and 10.0.7. • https://github.com/glpi-project/glpi/releases/tag/10.0.7 https://github.com/glpi-project/glpi/releases/tag/9.5.13 https://github.com/glpi-project/glpi/security/advisories/GHSA-r93q-chh5-jgh4 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.8EPSS: 2%CPEs: 1EXPL: 1CVE-2022-34128 – GLPI Cartography Plugin v6.0.0 - Unauthenticated Remote Code Execution (RCE)
https://notcve.org/view.php?id=CVE-2022-34128
The Cartography (aka positions) plugin before 6.0.1 for GLPI allows remote code execution via PHP code in the POST data to front/upload.php. GLPI Cartography versions prior to 6.0.0 suffers from a remote shell upload vulnerability. • https://www.exploit-db.com/exploits/51234 https://github.com/InfotelGLPI/positions/releases/tag/6.0.1 https://github.com/InfotelGLPI/positions/security/advisories/GHSA-947x-g9g9-rcmx https://pentest.blog/advisory-glpi-service-management-software-sql-injection-remote-code-execution-and-local-file-inclusion • CWE-434: Unrestricted Upload of File with Dangerous Type •
CVSS: 6.5EPSS: 1%CPEs: 1EXPL: 1CVE-2022-34125 – GLPI Activity v3.1.0 - Authenticated Local File Inclusion on Activity plugin
https://notcve.org/view.php?id=CVE-2022-34125
front/icon.send.php in the CMDB plugin before 3.0.3 for GLPI allows attackers to gain read access to sensitive information via a _log/ pathname in the file parameter. GLPI Activity versions prior to 3.1.0 suffer from a local file inclusion vulnerability. • https://www.exploit-db.com/exploits/51232 https://github.com/InfotelGLPI/cmdb/releases/tag/3.0.3 https://github.com/InfotelGLPI/cmdb/security/advisories/GHSA-wv59-3rv4-vm9f https://pentest.blog/advisory-glpi-service-management-software-sql-injection-remote-code-execution-and-local-file-inclusion • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 7.5EPSS: 2%CPEs: 1EXPL: 1CVE-2022-34127 – GLPI 4.0.2 - Unauthenticated Local File Inclusion on Manageentities plugin
https://notcve.org/view.php?id=CVE-2022-34127
The Managentities plugin before 4.0.2 for GLPI allows reading local files via directory traversal in the inc/cri.class.php file parameter. GLPI Manageentities versions prior to 4.0.2 suffer from a local file inclusion vulnerability. • https://www.exploit-db.com/exploits/51229 https://github.com/InfotelGLPI/manageentities/releases/tag/4.0.2 https://github.com/InfotelGLPI/manageentities/security/advisories/GHSA-4hpg-m8fv-xv3h https://pentest.blog/advisory-glpi-service-management-software-sql-injection-remote-code-execution-and-local-file-inclusion • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •