CVE-2022-39371

GLPI stands for Gestionnaire Libre de Parc Informatique. GLPI is a Free Asset and IT Management Software package that provides ITIL Service Desk features, licenses tracking and software auditing. Script related HTML tags in assets inventory information are not properly neutralized. This issue has been patched, please upgrade to version 10.0.4. There are currently no known workarounds.

CVSS v3 5.4 MEDIUM

5.4^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.3 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://github.com/glpi-project/glpi/security/advisories/GHSA-w7wc-728f-6mm8	Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:glpi-project:glpi:*:*:*:*:*:*:*:*

History

03 Nov 2022, 18:52

Type	Values Removed	Values Added
CPE		cpe:2.3:a:glpi-project:glpi::::::::
First Time		Glpi-project Glpi-project glpi
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 5.4
References	~~(CONFIRM) https://github.com/glpi-project/glpi/security/advisories/GHSA-w7wc-728f-6mm8 -~~	(CONFIRM) https://github.com/glpi-project/glpi/security/advisories/GHSA-w7wc-728f-6mm8 - Third Party Advisory
CWE		CWE-79

03 Nov 2022, 16:19

Type	Values Removed	Values Added
New CVE

Information

Published : 2022-11-03 16:15

Updated : 2023-12-10 14:35

NVD link : CVE-2022-39371

Mitre link : CVE-2022-39371

CVE.ORG link : CVE-2022-39371

JSON object : View

Products Affected

glpi-project

glpi

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CWE-80

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

{"id": "CVE-2022-39371", "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.3}, {"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "published": "2022-11-03T16:15:10.110", "references": [{"url": "https://github.com/glpi-project/glpi/security/advisories/GHSA-w7wc-728f-6mm8", "tags": ["Third Party Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-79"}]}, {"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-80"}]}], "descriptions": [{"lang": "en", "value": "GLPI stands for Gestionnaire Libre de Parc Informatique. GLPI is a Free Asset and IT Management Software package that provides ITIL Service Desk features, licenses tracking and software auditing. Script related HTML tags in assets inventory information are not properly neutralized. This issue has been patched, please upgrade to version 10.0.4. There are currently no known workarounds."}, {"lang": "es", "value": "GLPI significa Gestionnaire Libre de Parc Informatique. GLPI es un paquete gratuito de software de gesti\u00f3n de TI y activos que proporciona funciones de ITIL Service Desk, seguimiento de licencias y auditor\u00eda de software. Las etiquetas HTML relacionadas con scripts en la informaci\u00f3n del inventario de activos no se neutralizan adecuadamente. Este problema ha sido solucionado; actualice a la versi\u00f3n 10.0.4. Actualmente no se conocen workarounds."}], "lastModified": "2022-11-03T18:52:29.603", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:glpi-project:glpi:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0E4DD228-F8A9-4F70-96A1-4CBD89AAE233", "versionEndExcluding": "10.0.4", "versionStartIncluding": "10.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}