CVE-2022-31143
Leak of sensitive information through login page error in GLPI
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
GLPI stands for Gestionnaire Libre de Parc Informatique and is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. It was found that in affected versions there is an exposure of private information defined in setup of GLPI (like smtp or cas hosts). Note that passwords are not exposed. Users are advised to upgrade to version 10.0.3. There are no known workarounds for this issue.
GLPI son las siglas de Gestionnaire Libre de Parc Informatique y es un Paquete de Software Libre de Administración de Activos y TI, que proporciona funciones de Service Desk de ITIL, seguimiento de licencias y auditoría de software. Se ha detectado que en las versiones afectadas es expuesta información privada definida en la configuración de GLPI (como smtp o cas hosts). Nótese que las contraseñas no están expuestas. Es recomendado a usuarios actualizar a versión 10.0.3. No se presentan mitigaciones conocidas para este problema
CVSS Scores
SSVC
- Decision:-
Timeline
- 2022-05-18 CVE Reserved
- 2022-09-14 CVE Published
- 2024-04-06 EPSS Updated
- 2024-08-03 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
CAPEC
References (2)
URL | Tag | Source |
---|---|---|
https://github.com/glpi-project/glpi/security/advisories/GHSA-6mmq-x3j2-677j | Third Party Advisory |
URL | Date | SRC |
---|
URL | Date | SRC |
---|---|---|
https://github.com/glpi-project/glpi/commit/e66a0dfe697cbd4b3ec22736a8f8fd025a28f978 | 2022-09-19 |
URL | Date | SRC |
---|
Affected Vendors, Products, and Versions
Vendor | Product | Version | Other | Status | ||||||
---|---|---|---|---|---|---|---|---|---|---|
Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
Glpi-project Search vendor "Glpi-project" | Glpi Search vendor "Glpi-project" for product "Glpi" | < 10.0.3 Search vendor "Glpi-project" for product "Glpi" and version " < 10.0.3" | - |
Affected
|