CVSS: 9.6EPSS: 0%CPEs: 2EXPL: 0CVE-2023-28838 – GLPI vulnerable to SQL injection through dynamic reports
https://notcve.org/view.php?id=CVE-2023-28838
05 Apr 2023 — GLPI is a free asset and IT management software package. Starting in version 0.50 and prior to versions 9.5.13 and 10.0.7, a SQL Injection vulnerability allow users with access rights to statistics or reports to extract all data from database and, in some cases, write a webshell on the server. Versions 9.5.13 and 10.0.7 contain a patch for this issue. As a workaround, remove `Assistance > Statistics` and `Tools > Reports` read rights from every user. • https://github.com/glpi-project/glpi/releases/tag/10.0.7 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 4.8EPSS: 0%CPEs: 2EXPL: 0CVE-2023-28636 – GLPI vulnerable to stored Cross-site Scripting in external links
https://notcve.org/view.php?id=CVE-2023-28636
05 Apr 2023 — GLPI is a free asset and IT management software package. Starting in version 0.60 and prior to versions 9.5.13 and 10.0.7, a vulnerability allows an administrator to create a malicious external link. This issue is fixed in versions 9.5.13 and 10.0.7. • https://github.com/glpi-project/glpi/releases/tag/10.0.7 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.0EPSS: 0%CPEs: 2EXPL: 0CVE-2023-28634 – GLPI vulnerable to Privilege Escalation from Technician to Super-Admin
https://notcve.org/view.php?id=CVE-2023-28634
05 Apr 2023 — GLPI is a free asset and IT management software package. Starting in version 0.83 and prior to versions 9.5.13 and 10.0.7, a user who has the Technician profile could see and generate a Personal token for a Super-Admin. Using such token it is possible to negotiate a GLPI session and hijack the Super-Admin account, resulting in a Privilege Escalation. Versions 9.5.13 and 10.0.7 contain a patch for this issue. • https://github.com/glpi-project/glpi/releases/tag/10.0.7 • CWE-285: Improper Authorization CWE-863: Incorrect Authorization •
CVSS: 5.5EPSS: 0%CPEs: 2EXPL: 0CVE-2023-28633 – GLPI vulnerable to Blind Server-Side Request Forgery (SSRF) in RSS feeds
https://notcve.org/view.php?id=CVE-2023-28633
05 Apr 2023 — GLPI is a free asset and IT management software package. Starting in version 0.84 and prior to versions 9.5.13 and 10.0.7, usage of RSS feeds is subject to server-side request forgery (SSRF). In case the remote address is not a valid RSS feed, an RSS autodiscovery feature is triggered. This feature does not check safety or URLs. Versions 9.5.13 and 10.0.7 contain a patch for this issue. • https://github.com/glpi-project/glpi/commit/e2819da64c9075050805a44c834e1f4dc621a982 • CWE-918: Server-Side Request Forgery (SSRF) •
CVSS: 8.5EPSS: 0%CPEs: 2EXPL: 0CVE-2023-28632 – GLPI vulnerable to account takeover by authenticated user
https://notcve.org/view.php?id=CVE-2023-28632
05 Apr 2023 — GLPI is a free asset and IT management software package. Starting in version 0.83 and prior to versions 9.5.13 and 10.0.7, an authenticated user can modify emails of any user, and can therefore takeover another user account through the "forgotten password" feature. By modifying emails, the user can also receive sensitive data through GLPI notifications. Versions 9.5.13 and 10.0.7 contain a patch for this issue. As a workaround, account takeover can be prevented by deactivating all notifications related to `... • https://github.com/glpi-project/glpi/releases/tag/10.0.7 • CWE-269: Improper Privilege Management •
CVSS: 6.4EPSS: 2%CPEs: 2EXPL: 0CVE-2023-28639 – GLPI vulnerable to reflected Cross-site Scripting in search pages
https://notcve.org/view.php?id=CVE-2023-28639
05 Apr 2023 — GLPI is a free asset and IT management software package. Starting in version 0.85 and prior to versions 9.5.13 and 10.0.7, a malicious link can be crafted by an unauthenticated user. It will be able to exploit a reflected XSS in case any authenticated user opens the crafted link. This issue is fixed in versions 9.5.13 and 10.0.7. • https://github.com/glpi-project/glpi/releases/tag/10.0.7 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.8EPSS: 1%CPEs: 1EXPL: 2CVE-2022-34125 – GLPI Activity v3.1.0 - Authenticated Local File Inclusion on Activity plugin
https://notcve.org/view.php?id=CVE-2022-34125
03 Apr 2023 — front/icon.send.php in the CMDB plugin before 3.0.3 for GLPI allows attackers to gain read access to sensitive information via a _log/ pathname in the file parameter. GLPI Activity versions prior to 3.1.0 suffer from a local file inclusion vulnerability. • https://packetstorm.news/files/id/171655 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-203: Observable Discrepancy •
CVSS: 7.8EPSS: 5%CPEs: 1EXPL: 2CVE-2022-34127 – GLPI 4.0.2 - Unauthenticated Local File Inclusion on Manageentities plugin
https://notcve.org/view.php?id=CVE-2022-34127
03 Apr 2023 — The Managentities plugin before 4.0.2 for GLPI allows reading local files via directory traversal in the inc/cri.class.php file parameter. GLPI Manageentities versions prior to 4.0.2 suffer from a local file inclusion vulnerability. • https://packetstorm.news/files/id/171653 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 10.0EPSS: 9%CPEs: 1EXPL: 2CVE-2022-34128 – GLPI Cartography Plugin v6.0.0 - Unauthenticated Remote Code Execution (RCE)
https://notcve.org/view.php?id=CVE-2022-34128
03 Apr 2023 — The Cartography (aka positions) plugin before 6.0.1 for GLPI allows remote code execution via PHP code in the POST data to front/upload.php. GLPI Cartography versions prior to 6.0.0 suffers from a remote shell upload vulnerability. • https://packetstorm.news/files/id/171660 • CWE-434: Unrestricted Upload of File with Dangerous Type •
CVSS: 6.2EPSS: 0%CPEs: 2EXPL: 0CVE-2022-41941 – glpi contains XSS Stored inside Standard Interface Help Link href attribute
https://notcve.org/view.php?id=CVE-2022-41941
25 Jan 2023 — GLPI is a Free Asset and IT Management Software package. Versions 10.0.0 and above, prior to 10.0.6, are subject to Cross-site Scripting. An administrator may store malicious code in help links. This issue is patched in 10.0.6. GLPI es un paquete gratuito de software de gestión de TI y activos. • https://github.com/glpi-project/glpi/security/advisories/GHSA-qqqm-7h6v-7cf4 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •