CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2023-34106 – GLPI vulnerable to unauthorized access to User data
https://notcve.org/view.php?id=CVE-2023-34106
GLPI is a free asset and IT management software package. Versions of the software starting with 0.68 and prior to 10.0.8 have an incorrect rights check on a on a file accessible by an authenticated user. This allows access to the list of all users and their personal information. Users should upgrade to version 10.0.8 to receive a patch. • https://github.com/glpi-project/glpi/releases/tag/10.0.8 https://github.com/glpi-project/glpi/security/advisories/GHSA-923r-hqh4-wj7c • CWE-284: Improper Access Control CWE-863: Incorrect Authorization •
CVSS: 7.6EPSS: 0%CPEs: 1EXPL: 0CVE-2023-34254 – Remote inventory task command injection when using ssh command mode
https://notcve.org/view.php?id=CVE-2023-34254
The GLPI Agent is a generic management agent. Prior to version 1.5, if glpi-agent is running remoteinventory task against an Unix platform with ssh command, an administrator user on the remote can manage to inject a command in a specific workflow the agent would run with the privileges it uses. In the case, the agent is running with administration privileges, a malicious user could gain high privileges on the computer glpi-agent is running on. A malicious user could also disclose all remote accesses the agent is configured with for remoteinventory task. This vulnerability has been patched in glpi-agent 1.5. • https://github.com/glpi-project/glpi-agent/blob/dd313ee0914becf74c0e48cb512765210043b478/Changes#L98 https://github.com/glpi-project/glpi-agent/security/advisories/GHSA-39vc-hxgm-j465 • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2022-34126
https://notcve.org/view.php?id=CVE-2022-34126
The Activity plugin before 3.1.1 for GLPI allows reading local files via directory traversal in the front/cra.send.php file parameter. • https://github.com/InfotelGLPI/activity/releases/tag/3.1.1 https://github.com/InfotelGLPI/activity/security/advisories/GHSA-jcmw-hpgh-357p https://pentest.blog/advisory-glpi-service-management-software-sql-injection-remote-code-execution-and-local-file-inclusion • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 8.8EPSS: 0%CPEs: 2EXPL: 0CVE-2023-29006 – Order GLPI plugin vulnerable to remote code execution from authenticated user
https://notcve.org/view.php?id=CVE-2023-29006
The Order GLPI plugin allows users to manage order management within GLPI. Starting with version 1.8.0 and prior to versions 2.7.7 and 2.10.1, an authenticated user that has access to standard interface can craft an URL that can be used to execute a system command. Versions 2.7.7 and 2.10.1 contain a patch for this issue. As a workaround, delete the `ajax/dropdownContact.php` file from the plugin. • https://github.com/pluginsGLPI/order/commit/c78e64b95e54d5e47d9835984c93049f245b579e https://github.com/pluginsGLPI/order/security/advisories/GHSA-xfx2-qx2r-3wwm • CWE-502: Deserialization of Untrusted Data •
CVSS: 4.8EPSS: 0%CPEs: 2EXPL: 0CVE-2023-28852 – GLPI vulnerable to stored Cross-site Scripting through dashboard administration
https://notcve.org/view.php?id=CVE-2023-28852
GLPI is a free asset and IT management software package. Starting in version 9.5.0 and prior to versions 9.5.13 and 10.0.7, a user with dashboard administration rights may hack the dashboard form to store malicious code that will be executed when other users will use the related dashboard. Versions 9.5.13 and 10.0.7 contain a patch for this issue. • https://github.com/glpi-project/glpi/releases/tag/10.0.7 https://github.com/glpi-project/glpi/releases/tag/9.5.13 https://github.com/glpi-project/glpi/security/advisories/GHSA-65gq-p8hg-7m92 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •