Vulnerability · Published Apr 5, 2023 · Assigned by GitHub_M
CVE-2023-28855Fields GLPI plugin vulnerable to unauthorized write access to additional fields
Medium 6.5
In plain English
A medium-severity privilege mismanagement in fields from pluginsGLPI. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 49% of all known vulnerabilities).
Severity (CVSS 3.1)6.5Medium
Exploit odds (30 days)0.6%top 50.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Fields is a GLPI plugin that allows users to add custom fields on GLPI items forms. Prior to versions 1.13.1 and 1.20.4, lack of access control check allows any authenticated user to write data to any fields container, including those to which they have no configured access. Versions 1.13.1 and 1.20.4 contain a patch for this issue.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| pluginsGLPI | fields | < 1.13.1>= 1.20.0, < 1.20.4 |
Weakness: CWE-269 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
References
- https://github.com/pluginsGLPI/fields/security/advisories/GHSA-52vv-hm4x-8584 x_refsource_CONFIRM
- https://github.com/pluginsGLPI/fields/commit/784260be7db185bb1e7d66b299997238c4c0205d x_refsource_MISC
- https://github.com/pluginsGLPI/fields/releases/tag/1.13.1 x_refsource_MISC
- https://github.com/pluginsGLPI/fields/releases/tag/1.20.4 x_refsource_MISC