CVE-2022-29250
SQL injection in GLPI
Severity Score
6.5
*CVSS v3.1
Exploit Likelihood
*EPSS
Affected Versions
*CPE
Public Exploits
0
*Multiple Sources
Exploited in Wild
-
*KEV
Decision
-
*SSVC
Descriptions
GLPI is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. In versions prior to version 10.0.1 it is possible to add extra information by SQL injection on search pages. In order to exploit this vulnerability a user must be logged in.
GLPI es un paquete de software gratuito de administración de activos y TI que ofrece funciones de Service Desk de ITIL, seguimiento de licencias y auditoría de software. En versiones anteriores a 10.0.1, es posible añadir información extra mediante inyección SQL en las páginas de búsqueda. Para explotar esta vulnerabilidad un usuario debe estar conectado
*Credits:
N/A
CVSS Scores
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Attack Vector
Attack Complexity
Authentication
Confidentiality
Integrity
Availability
* Common Vulnerability Scoring System
SSVC
- Decision:-
Exploitation
Automatable
Tech. Impact
* Organization's Worst-case Scenario
Timeline
- 2022-04-13 CVE Reserved
- 2022-06-09 CVE Published
- 2023-12-31 EPSS Updated
- 2024-08-03 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CAPEC
References (1)
| URL | Tag | Source |
|---|---|---|
| https://github.com/glpi-project/glpi/security/advisories/GHSA-5w33-4wrx-8hvw | Third Party Advisory |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Glpi-project Search vendor "Glpi-project" | Glpi Search vendor "Glpi-project" for product "Glpi" | 10.0.0 Search vendor "Glpi-project" for product "Glpi" and version "10.0.0" | - |
Affected
| ||||||
| Glpi-project Search vendor "Glpi-project" | Glpi Search vendor "Glpi-project" for product "Glpi" | 10.0.0 Search vendor "Glpi-project" for product "Glpi" and version "10.0.0" | beta |
Affected
| ||||||
| Glpi-project Search vendor "Glpi-project" | Glpi Search vendor "Glpi-project" for product "Glpi" | 10.0.0 Search vendor "Glpi-project" for product "Glpi" and version "10.0.0" | rc1 |
Affected
| ||||||
| Glpi-project Search vendor "Glpi-project" | Glpi Search vendor "Glpi-project" for product "Glpi" | 10.0.0 Search vendor "Glpi-project" for product "Glpi" and version "10.0.0" | rc2 |
Affected
| ||||||
| Glpi-project Search vendor "Glpi-project" | Glpi Search vendor "Glpi-project" for product "Glpi" | 10.0.0 Search vendor "Glpi-project" for product "Glpi" and version "10.0.0" | rc3 |
Affected
| ||||||