// For flags

CVE-2023-23610

glpi vulnerable to Unauthorized access to data export

Severity Score

6.5
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

GLPI is a Free Asset and IT Management Software package. Versions prior to 9.5.12 and 10.0.6 are vulnerable to Improper Privilege Management. Any user having access to the standard interface can export data of almost any GLPI item type, even those on which user is not allowed to access (including assets, tickets, users, ...). This issue is patched in 10.0.6.

GLPI es un paquete gratuito de software de gestión de TI y activos. Las versiones anteriores a 9.5.12 y 10.0.6 son vulnerables a una gestión de privilegios inadecuada. Cualquier usuario que tenga acceso a la interfaz estándar puede exportar datos de casi cualquier tipo de elemento GLPI, incluso aquellos a los que el usuario no tiene acceso (incluidos activos, tickets, usuarios,...). Este problema se solucionó en 10.0.6.

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2023-01-16 CVE Reserved
  • 2023-01-25 CVE Published
  • 2024-08-02 CVE Updated
  • 2024-08-17 EPSS Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-269: Improper Privilege Management
  • CWE-732: Incorrect Permission Assignment for Critical Resource
CAPEC
References (1)
URL Tag Source
https://github.com/glpi-project/glpi/security/advisories/GHSA-6565-hm87-24hf Third Party Advisory
URL Date SRC
URL Date SRC
URL Date SRC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Glpi-project
Search vendor "Glpi-project"
 Glpi
Search vendor "Glpi-project" for product "Glpi"
 >= 0.65 < 9.5.12
Search vendor "Glpi-project" for product "Glpi" and version " >= 0.65 < 9.5.12"
-
Affected
Glpi-project
Search vendor "Glpi-project"
 Glpi
Search vendor "Glpi-project" for product "Glpi"
 >= 10.0.0 < 10.0.6
Search vendor "Glpi-project" for product "Glpi" and version " >= 10.0.0 < 10.0.6"
-
Affected