CVE-2022-39372

GLPI stands for Gestionnaire Libre de Parc Informatique. GLPI is a Free Asset and IT Management Software package that provides ITIL Service Desk features, licenses tracking and software auditing. Authenticated users may store malicious code in their account information. This issue has been patched, please upgrade to version 10.0.4. There are currently no known workarounds.

CVSS v3 5.4 MEDIUM

5.4^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.3 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://github.com/glpi-project/glpi/security/advisories/GHSA-5rj7-95qc-89h2	Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:glpi-project:glpi:*:*:*:*:*:*:*:*

History

03 Nov 2022, 18:56

Type	Values Removed	Values Added
References	~~(CONFIRM) https://github.com/glpi-project/glpi/security/advisories/GHSA-5rj7-95qc-89h2 -~~	(CONFIRM) https://github.com/glpi-project/glpi/security/advisories/GHSA-5rj7-95qc-89h2 - Third Party Advisory
CPE		cpe:2.3:a:glpi-project:glpi::::::::
CWE		CWE-79
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 5.4
First Time		Glpi-project Glpi-project glpi

03 Nov 2022, 16:19

Type	Values Removed	Values Added
New CVE

Information

Published : 2022-11-03 16:15

Updated : 2023-12-10 14:35

NVD link : CVE-2022-39372

Mitre link : CVE-2022-39372

CVE.ORG link : CVE-2022-39372

JSON object : View

Products Affected

glpi-project

glpi

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CWE-80

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

{"id": "CVE-2022-39372", "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.3}, {"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.5, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 2.1}]}, "published": "2022-11-03T16:15:10.210", "references": [{"url": "https://github.com/glpi-project/glpi/security/advisories/GHSA-5rj7-95qc-89h2", "tags": ["Third Party Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-79"}]}, {"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-79"}, {"lang": "en", "value": "CWE-80"}]}], "descriptions": [{"lang": "en", "value": "GLPI stands for Gestionnaire Libre de Parc Informatique. GLPI is a Free Asset and IT Management Software package that provides ITIL Service Desk features, licenses tracking and software auditing. Authenticated users may store malicious code in their account information. This issue has been patched, please upgrade to version 10.0.4. There are currently no known workarounds."}, {"lang": "es", "value": "GLPI significa Gestionnaire Libre de Parc Informatique. GLPI es un paquete gratuito de software de gesti\u00f3n de TI y activos que proporciona funciones de ITIL Service Desk, seguimiento de licencias y auditor\u00eda de software. Los usuarios autenticados pueden almacenar c\u00f3digo malicioso en la informaci\u00f3n de su cuenta. Este problema ha sido solucionado; actualice a la versi\u00f3n 10.0.4. Actualmente no se conocen workarounds."}], "lastModified": "2022-11-03T18:56:52.993", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:glpi-project:glpi:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "575E19F1-5D9C-4AA1-9CC5-FC359BB2353B", "versionEndExcluding": "10.0.4", "versionStartIncluding": "0.70"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}