Vulnerability · Published Apr 5, 2023 · Assigned by GitHub_M

CVE-2023-29006Order GLPI plugin vulnerable to remote code execution from authenticated user

High 8.8

In plain English

A high-severity unsafe deserialization in order from pluginsGLPI. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 59% of all known vulnerabilities).

Severity (CVSS 3.1)8.8High

Exploit odds (30 days)0.9%top 41.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

The Order GLPI plugin allows users to manage order management within GLPI. Starting with version 1.8.0 and prior to versions 2.7.7 and 2.10.1, an authenticated user that has access to standard interface can craft an URL that can be used to execute a system command. Versions 2.7.7 and 2.10.1 contain a patch for this issue. As a workaround, delete the `ajax/dropdownContact.php` file from the plugin.

Affected products (as reported)

Vendor	Product	Versions
pluginsGLPI	order	>= 1.8.0, < 2.7.7>= 2.10.0, < 2.10.1

Weakness: CWE-502 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

https://github.com/pluginsGLPI/order/security/advisories/GHSA-xfx2-qx2r-3wwm x_refsource_CONFIRM
https://github.com/pluginsGLPI/order/commit/c78e64b95e54d5e47d9835984c93049f245b579e x_refsource_MISC