by Kastro
Paper/Archive/CVE-2022-31056

CVE-2022-31056

glpi-project glpi — SQL injection with _actor parameter in GLPI

EPSS 10%CVSS 9.8
critical.is priorityof 100
49
CVSS 9.8 (NVD, CNA agree)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 95.6.956 × 2019.1No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. In affected versions all assistance forms (Ticket/Change/Problem) permit sql injection on the actor fields. This issue has been resolved in version 10.0.2 and all affected users are advised to upgrade.

Affected

ProductAffectedFixed inSource
glpi>= 10.0.0, < 10.0.2–CNA

Scores by source

GitHub_M (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refgithub.com/glpi-project/glpi/security/advisories/GHSA-9q9x-7xxh-w4cgrefpacketstormsecurity.com/files/171656/GLPI-10.0.2-SQL-Injection-Remote-Code-Execution.html