Vulnerability · Published Apr 5, 2023 · Assigned by GitHub_M

CVE-2023-28849GLPI vulnerable to SQL injection and Stored XSS via inventory agent request

Critical 10.0

In plain English

A critical-severity SQL injection in glpi from glpi-project. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 42% of all known vulnerabilities).

Severity (CVSS 3.1)10.0Critical

Exploit odds (30 days)0.5%top 57.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

GLPI is a free asset and IT management software package. Starting in version 10.0.0 and prior to version 10.0.7, GLPI inventory endpoint can be used to drive a SQL injection attack. It can also be used to store malicious code that could be used to perform XSS attack. By default, GLPI inventory endpoint requires no authentication. Version 10.0.7 contains a patch for this issue. As a workaround, disable native inventory.

Affected products (as reported)

Vendor	Product	Versions
glpi-project	glpi	>= 10.0.0, < 10.0.7

Weakness: CWE-89, CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N

References

https://github.com/glpi-project/glpi/security/advisories/GHSA-9r84-jpg3-h4m6 x_refsource_CONFIRM
https://github.com/glpi-project/glpi/releases/tag/10.0.7 x_refsource_MISC