CVSS: 6.8EPSS: 0%CPEs: 2EXPL: 0CVE-2023-28855 – Fields GLPI plugin vulnerable to unauthorized write access to additional fields
https://notcve.org/view.php?id=CVE-2023-28855
05 Apr 2023 — Fields is a GLPI plugin that allows users to add custom fields on GLPI items forms. Prior to versions 1.13.1 and 1.20.4, lack of access control check allows any authenticated user to write data to any fields container, including those to which they have no configured access. Versions 1.13.1 and 1.20.4 contain a patch for this issue. • https://github.com/pluginsGLPI/fields/commit/784260be7db185bb1e7d66b299997238c4c0205d • CWE-269: Improper Privilege Management •
CVSS: 9.8EPSS: 1%CPEs: 1EXPL: 0CVE-2019-12723
https://notcve.org/view.php?id=CVE-2019-12723
10 Jul 2019 — An issue was discovered in the Teclib Fields plugin through 1.9.2 for GLPI. it allows SQL Injection via container_id and old_order parameters to ajax/reorder.php by an unauthenticated user. Se detectó un problema en el plugin Fields hasta versión 1.9.2 de Teclib para GLPI. Esto permite una Inyección SQL por medio de los parámetros container_id y old_order en el archivo ajax/reorder.php por parte de un usuario no identificado. • https://github.com/pluginsGLPI/fields/blob/master/ajax/reorder.php • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •