// For flags

CVE-2023-22500

glpi Unauthorized access to inventory files

Severity Score

7.5
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

GLPI is a Free Asset and IT Management Software package. Versions 10.0.0 and above, prior to 10.0.6 are vulnerable to Incorrect Authorization. This vulnerability allow unauthorized access to inventory files. Thus, if anonymous access to FAQ is allowed, inventory files are accessbile by unauthenticated users. This issue is patched in version 10.0.6. As a workaround, disable native inventory and delete inventory files from server (default location is `files/_inventory`).

GLPI es un paquete gratuito de software de gestión de TI y activos. Las versiones 10.0.0 y superiores, anteriores a la 10.0.6, son vulnerables a una autorización incorrecta. Esta vulnerabilidad permite el acceso no autorizado a archivos de inventario. Por lo tanto, si se permite el acceso anónimo a las preguntas frecuentes, los usuarios no autenticados podrán acceder a los archivos de inventario. Este problema se solucionó en la versión 10.0.6. Como workaround, deshabilite el inventario nativo y elimine los archivos de inventario del servidor (la ubicación predeterminada es `files/_inventory`).

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2022-12-29 CVE Reserved
  • 2023-01-25 CVE Published
  • 2024-08-02 CVE Updated
  • 2024-08-17 EPSS Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-863: Incorrect Authorization
CAPEC
References (1)
URL Tag Source
https://github.com/glpi-project/glpi/security/advisories/GHSA-3ghv-p34r-5ghx Third Party Advisory
URL Date SRC
URL Date SRC
URL Date SRC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Glpi-project
Search vendor "Glpi-project"
 Glpi
Search vendor "Glpi-project" for product "Glpi"
 >= 10.0.0 < 10.0.6
Search vendor "Glpi-project" for product "Glpi" and version " >= 10.0.0 < 10.0.6"
-
Affected