GLPI is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. In versions prior to version 10.0.1 it is possible to add extra information by SQL injection on search pages. In order to exploit this vulnerability a user must be logged in.
References
| Link | Resource |
|---|---|
| https://github.com/glpi-project/glpi/security/advisories/GHSA-5w33-4wrx-8hvw | Third Party Advisory |
Configurations
Configuration 1 (hide)
|
History
16 Jun 2022, 19:35
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Glpi-project
Glpi-project glpi |
|
| CPE | cpe:2.3:a:glpi-project:glpi:10.0.0:-:*:*:*:*:*:* cpe:2.3:a:glpi-project:glpi:10.0.0:rc1:*:*:*:*:*:* cpe:2.3:a:glpi-project:glpi:10.0.0:beta:*:*:*:*:*:* cpe:2.3:a:glpi-project:glpi:10.0.0:rc3:*:*:*:*:*:* cpe:2.3:a:glpi-project:glpi:10.0.0:rc2:*:*:*:*:*:* |
|
| References | (CONFIRM) https://github.com/glpi-project/glpi/security/advisories/GHSA-5w33-4wrx-8hvw - Third Party Advisory | |
| CVSS |
v2 : v3 : |
v2 : 4.0
v3 : 6.5 |
09 Jun 2022, 20:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2022-06-09 20:15
Updated : 2023-12-10 14:22
NVD link : CVE-2022-29250
Mitre link : CVE-2022-29250
CVE.ORG link : CVE-2022-29250
JSON object : View
Products Affected
glpi-project
- glpi
CWE
CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')