CVSS: 7.7EPSS: 0%CPEs: 1EXPL: 0CVE-2024-45600 – Fields GLPI plugin has an Authenticated SQL Injection
https://notcve.org/view.php?id=CVE-2024-45600
26 Dec 2024 — Fields is a GLPI plugin that allows users to add custom fields on GLPI items forms. Prior to 1.21.13, an authenticated user can perform a SQL injection when the plugin is active. The vulnerability is fixed in 1.21.13. • https://github.com/pluginsGLPI/fields/commit/eb927b0f084ee4ef6c87ab2eb7a15e99369e74ae#diff-a7024a397fba9a026157683da73cc675ec6b73bd900374b3836bcdc76ec7bd5cR1166 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 6.8EPSS: 0%CPEs: 2EXPL: 0CVE-2023-28855 – Fields GLPI plugin vulnerable to unauthorized write access to additional fields
https://notcve.org/view.php?id=CVE-2023-28855
05 Apr 2023 — Fields is a GLPI plugin that allows users to add custom fields on GLPI items forms. Prior to versions 1.13.1 and 1.20.4, lack of access control check allows any authenticated user to write data to any fields container, including those to which they have no configured access. Versions 1.13.1 and 1.20.4 contain a patch for this issue. • https://github.com/pluginsGLPI/fields/commit/784260be7db185bb1e7d66b299997238c4c0205d • CWE-269: Improper Privilege Management •