by Kastro
Paper/Archive/CVE-2023-42462

CVE-2023-42462

glpi-project glpi — File deletion through document upload process in GLPI

EPSS 1%CVSS 9.1
critical.is priorityof 100
41
CVSS 9.1 (NVD)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 70.0.700 × 2014.0No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

GLPI stands for Gestionnaire Libre de Parc Informatique is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. The document upload process can be diverted to delete some files. Users are advised to upgrade to version 10.0.10. There are no known workarounds for this vulnerability.

Affected

ProductAffectedFixed inSource
glpi>= 10.0.0, < 10.0.10–CNA

Scores by source

NVD9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
GitHub_M (CNA)7.7CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: partial

References

refgithub.com/glpi-project/glpi/security/advisories/GHSA-hm76-jh96-7j75