Actively exploited · Published Sep 19, 2022 · Assigned by mitre
CVE-2022-35914
Critical 9.8 Exploited
In plain English
A critical-severity injection in GLPI from Teclib. Attackers are actively exploiting it in the wild (listed by CISA on March 7, 2023). The chance it is exploited in the next 30 days is estimated at 99.9% (higher than 99.9% of all known vulnerabilities). Ready-made attack tooling exists: Metasploit, Nuclei, public proof-of-concept code. Apply updates per vendor instructions.
Severity (CVSS 3.1)9.8Critical
Exploit odds (30 days)99.9%top 0.0% of all CVEs
Exploited in the wildYesCISA KEV since Mar 7, 2023
Attack tooling3Metasploit, Nuclei, Public PoC
CISA guidance
Apply updates per vendor instructions.
Federal agencies must remediate by Mar 28, 2023.
Official description
/vendor/htmlawed/htmlawed/htmLawedTest.php in the htmlawed module for GLPI through 10.0.2 allows PHP code injection.
Affected products (as reported)
Weakness: CWE-74 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- http://www.bioinformatics.org/phplabware/sourceer/sourceer.php?&Sfs=htmLawedTest.php&Sl=.%2Finternal_utilities%2FhtmLawed
- https://github.com/glpi-project/glpi/releases
- https://glpi-project.org/fr/glpi-10-0-3-disponible/
- http://packetstormsecurity.com/files/169501/GLPI-10.0.2-Command-Injection.html
- https://github.com/Orange-Cyberdefense/CVE-repository/
- https://github.com/Orange-Cyberdefense/CVE-repository/blob/master/PoCs/POC_2022-35914.sh
- https://mayfly277.github.io/posts/GLPI-htmlawed-CVE-2022-35914/
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-35914 government-resource