CVSS: 8.1EPSS: 0%CPEs: 2EXPL: 0CVE-2023-28632 – GLPI vulnerable to account takeover by authenticated user
https://notcve.org/view.php?id=CVE-2023-28632
GLPI is a free asset and IT management software package. Starting in version 0.83 and prior to versions 9.5.13 and 10.0.7, an authenticated user can modify emails of any user, and can therefore takeover another user account through the "forgotten password" feature. By modifying emails, the user can also receive sensitive data through GLPI notifications. Versions 9.5.13 and 10.0.7 contain a patch for this issue. As a workaround, account takeover can be prevented by deactivating all notifications related to `Forgotten password? • https://github.com/glpi-project/glpi/releases/tag/10.0.7 https://github.com/glpi-project/glpi/releases/tag/9.5.13 https://github.com/glpi-project/glpi/security/advisories/GHSA-7pwm-pg76-3q9x • CWE-269: Improper Privilege Management •
CVSS: 6.2EPSS: 0%CPEs: 2EXPL: 0CVE-2022-41941 – glpi contains XSS Stored inside Standard Interface Help Link href attribute
https://notcve.org/view.php?id=CVE-2022-41941
GLPI is a Free Asset and IT Management Software package. Versions 10.0.0 and above, prior to 10.0.6, are subject to Cross-site Scripting. An administrator may store malicious code in help links. This issue is patched in 10.0.6. GLPI es un paquete gratuito de software de gestión de TI y activos. • https://github.com/glpi-project/glpi/security/advisories/GHSA-qqqm-7h6v-7cf4 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.2EPSS: 0%CPEs: 2EXPL: 0CVE-2023-22725 – glpi vulnerable to XSS on external links
https://notcve.org/view.php?id=CVE-2023-22725
GLPI is a Free Asset and IT Management Software package. Versions 0.6.0 and above, prior to 10.0.6 are vulnerable to Cross-site Scripting. This vulnerability allow for an administrator to create a malicious external link. This issue is patched in 10.0.6. GLPI es un paquete gratuito de software de gestión de TI y activos. • https://github.com/glpi-project/glpi/security/advisories/GHSA-f5g6-fxrw-pfj7 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.5EPSS: 0%CPEs: 2EXPL: 0CVE-2023-23610 – glpi vulnerable to Unauthorized access to data export
https://notcve.org/view.php?id=CVE-2023-23610
GLPI is a Free Asset and IT Management Software package. Versions prior to 9.5.12 and 10.0.6 are vulnerable to Improper Privilege Management. Any user having access to the standard interface can export data of almost any GLPI item type, even those on which user is not allowed to access (including assets, tickets, users, ...). This issue is patched in 10.0.6. GLPI es un paquete gratuito de software de gestión de TI y activos. • https://github.com/glpi-project/glpi/security/advisories/GHSA-6565-hm87-24hf • CWE-269: Improper Privilege Management CWE-732: Incorrect Permission Assignment for Critical Resource •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2022-39376 – Improper input validation on emails links in GLPI
https://notcve.org/view.php?id=CVE-2022-39376
GLPI stands for Gestionnaire Libre de Parc Informatique. GLPI is a Free Asset and IT Management Software package that provides ITIL Service Desk features, licenses tracking and software auditing. Users may be able to inject custom fields values in `mailto` links. This issue has been patched, please upgrade to version 10.0.4. There are currently no known workarounds. • https://github.com/glpi-project/glpi/security/advisories/GHSA-6rh5-m5g7-327w • CWE-20: Improper Input Validation •